[0x000NULL]

Fixes #439

--aws-profile was only used when building master keys from --kms (and for groups add). Anything that works from an existing file (decrypt, edit, rotate, set, unset, exec-env, exec-file, publish, updatekeys, groups add/delete) loaded the keys from the file's metadata and used the stored aws_profile, so the flag had no effect there.

Now, when --aws-profile is given, it replaces the AWS profile of every AWS KMS key in the file for that invocation, including keys that have different per-key profiles stored. The override is in memory only and is never written to a file: kms.MasterKey gets a non-serialized AwsProfileOverride field that takes precedence over AwsProfile when creating the AWS config and when sending the key to a key service. ToMap, ToString and the stores are untouched, so the stored aws_profile values, rotate --rm-kms matching and the updatekeys diff are unchanged. Profile names that only make sense in one environment (for example a CI profile) therefore do not end up in the file. With a remote key service, the profile name is resolved on the key service host.

The only place the flag is persisted is when new keys are created from it, as before: --kms together with --aws-profile, and now also keys taken from a .sops.yaml creation rule when encrypting a new file. There the flag overrides the rule's aws_profile.

Changes:

• common.SetAWSProfile sets the override on all KMS keys of a set of key groups, and does nothing for an empty profile. It is called everywhere keys are loaded from a file: LoadEncryptedFileWithBugFixes (decrypt, edit, rotate, set, unset, exec-env, exec-file, also after the encryption context fix reloads the tree), the edit --show-master-keys editor loop (which re-parses the keys from the edited text), publish, updatekeys and groups add/delete. In updatekeys it is also applied to the creation-rule groups, so that newly added rule keys are encrypted with the flag's profile; the file still gets the rule's aws_profile, not the flag's. common.PersistAWSProfile is used for creation rules when encrypting.
• --aws-profile is added to rotate, decrypt, set, unset, exec-env, exec-file, publish, updatekeys and groups delete, and the help text everywhere now says it overrides any aws_profile stored in the file or .sops.yaml.
• Tests cover the flag overriding the stored profile on load, the override not being emitted when the tree is written, SetAWSProfile (empty profile, non-KMS keys), and the override being preferred by EffectiveAwsProfile and the key service conversion.

This builds on #1659. Thanks to @martelli for the original work and to @felixfontein for the review. The review points are handled as follows:

• AWS_PROFILE is not read. Only the explicit flag overrides the stored value, so users who have AWS_PROFILE set in their environment see no change.
• No environment lookups in library code. The flag value is read in cmd/sops/main.go and passed down through the opts structs.
• All call sites that load keys from metadata are changed, not only one of the decryptOpts creations.

Behavior change: --aws-profile now also applies when decrypting and when otherwise using the keys stored in a file. Previously it was ignored there.