Secrets and encryption

Two hooks hand the agent server what it must never store: the value of a secret, from a vault of your own, and the key for end-to-end encryption. Both return a value, and both are called only when the matching setting on the Secrets & encryption page points at them.

Hook	When it is called	The dict holds
`vault`Secrets vault	When an agent reads a secret with `sys.secret` and the secrets source is `vault`. It returns the value; `None` means the secret does not exist. The agent server keeps a value for 15 minutes. See Secret vault.	`name`.
`encryptionKey`Encryption key	When the agent server needs a key for end-to-end encryption. It returns the key as 16, 24 or 32 bytes. The Secrets & encryption page calls it once with the current key's name when the settings are saved, and refuses the save when the hook fails or returns anything else. See Encryption.	`keyName`.