Add blind index support for encrypted fields

[Kyzegs]

Summary

Adds blind index support for encrypted fields so applications can enforce uniqueness and perform lookups without using deterministic encryption.

Changes

• Add BlindIndex attribute for lookup hash columns
• Add HMAC-SHA256 blind index hasher service
• Add shared blind-index metadata provider and updater services
• Update Doctrine listener to maintain blind indexes when source fields change
• Add encrypt:blind-index command to rebuild lookup hashes through Doctrine
• Document encrypted value plus lookup hash usage
• Add unit tests for blind-index behavior