feat: per-file encryption and DuckLake secrets management

[qsliu2017]

Parent: #124

Summary

Upstream ducklake supports per-file encryption (data files can be encrypted at rest) and has a dedicated secret type for credential management. pg_ducklake does not yet expose these capabilities.

Features

Per-file encryption

• Attach encryption mode: AUTOMATIC, ENCRYPTED, or UNENCRYPTED
• Encryption key management per file
• Transparent encryption/decryption during read/write

DuckLake secret type

• Dedicated secret type for DuckLake credential management
• Default secret __default_ducklake
• Path-based secret resolution for cloud storage credentials
• Integration with DuckDB's secrets infrastructure

Implementation notes

• Encryption likely requires DuckDB-side configuration; pg_ducklake needs to expose the attach parameters
• Secrets management may overlap with pg_duckdb's existing secrets support -- coordinate to avoid duplication
• Consider how PG-side credential management (e.g., .pgpass, CREATE USER MAPPING) should interact
• Lower priority than other feature gaps unless users specifically need encrypted storage