Sframe encryptor implementation

This CL introduces the concrete Sframe encryptor that sits between the
public key-management API and the media pipeline, implementing the
sender-side wiring for Sframe end-to-end encryption.

# High-level design
The implementation follows a three-layer split that matches the existing
WebRTC layering and respects the api/ visibility rules: 1. Public API
layer (api/sframe/) - A narrow, stable interface that exposes only key
management to applications: setting an encryption key on the sender
side.

2. Internal media interface layer (modules/sframe/) - Extends the public
key-management interface with the Encrypt and "max ciphertext size"
entry points used by the media pipeline. This is the surface the media
channel speaks to; application code never sees it.

3. Concrete impl layer (modules/sframe/) - Implements the media
interface on top of the cisco/sframe library.

Splitting key management from frame protection lets the public handle
expose only the small surface applications need, while the media
pipeline talks to a richer interface internally.

Bug: webrtc:479862368
Change-Id: Id93dba5874b6f5b1f32723755dd404af202f6ecf
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/481301
Reviewed-by: Harald Alvestrand <hta@webrtc.org>
Reviewed-by: Tomas Gunnarsson <tommi@webrtc.org>
Commit-Queue: Tomas Gunnarsson <tommi@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#48065}