fix switching from sparse keys to default

[justintsteele]

When switching from sparse keys to default keys, the default keys never get updated and the sparse keys never get deleted rendering the vault inaccessible.

Description

As a means of example, beginning with a vault in default keys mode, everything is as expected:

irb(main):133> Chef::DataBagItem.load("test_vault", "test_val_keys").raw_data
=>
{"id"=>"test_val_keys",
 "admins"=>["jtsteele"],
 "clients"=>[],
 "search_query"=>[],
 "mode"=>"default",
 "jtsteele"=> "==redacted key==\n"}
irb(main):134> Chef::DataBagItem.load("test_vault", "test_val_key_jtsteele").raw_data
/opt/chef-workstation/embedded/lib/ruby/3.1.0/net/http/response.rb:142:in `error!': 404 "Object Not Found" (Net::HTTPClientException)

If we then switch to sparse keys mode, everything is still as expected:

irb(main):137> Chef::DataBagItem.load("test_vault", "test_val_keys").raw_data
=> {"id"=>"test_val_keys", "admins"=>["jtsteele"], "clients"=>[], "search_query"=>[], "mode"=>"sparse"}
irb(main):138> Chef::DataBagItem.load("test_vault", "test_val_key_jtsteele").raw_data
=>
{"id"=>"test_val_key_jtsteele",
 "jtsteele"=> "==new redacted key==\n"}

If we switch back to default keys mode, without this fix, we get the following:

irb(main):139> Chef::DataBagItem.load("test_vault", "test_val_keys").raw_data
=> {"id"=>"test_val_keys", "admins"=>["jtsteele"], "clients"=>[], "search_query"=>[], "mode"=>"default"}
irb(main):140> Chef::DataBagItem.load("test_vault", "test_val_key_jtsteele").raw_data
=>
{"id"=>"test_val_key_jtsteele",
 "jtsteele"=> "==yet another new redacted key==\n"}

and probably most importantly:

> knife vault show test_vault test_val
ERROR: ChefVault::Exceptions::SecretDecryption: test_vault/test_val is not encrypted with your public key.  Contact an administrator of the vault item to encrypt for you!

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Chore (non-breaking change that does not add functionality or fix an issue)

Checklist:

• I have read the CONTRIBUTING document.
• I have run the pre-merge tests locally and they pass.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• If Gemfile.lock has changed, I have used --conservative to do it and included the full output in the Description above.
• All new and existing tests passed.
• All commits have been signed-off for the Developer Certificate of Origin.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud