Reduce allocations and copying by decrypting into a buffer

[rfk]

Our current Cryptographer trait decrypts from a &[u8] and returns a Vec<u8>, for simplicity. This means that each decryption operation must allocate a new Vec to hold the result, and then we copy the bytes out of that temporary Vec and into the final output Vec.

We could reduce the amount of allocation and copying going on here if our Cryptographer trait instead accepted an output buffer as argument and decrypted into it. That's actually out the existing openssl backend works under the hood already, we just wrap it in automatic creation of the Vec.

Not urgent, but could be a nice little improvement.