M5: deletion delay with trash, passphrase slots, ransomware documentation

- removed snapshots go to a trash on the location and their data is only
  freed after the deletion delay, which is chosen when the key is created
  (default 7 days, 1-365) and cannot be changed afterwards; any admin can
  bring them back (occ backup:trash, backup:trash:restore, web UI)
- up to three passphrase slots open the same master key (like LUKS), so
  one person leaving or dying does not lock the company out; slot changes
  are written to every location, announced to all admins and require a
  new recovery kit confirmation, while backups keep running
- occ backup:key:slots, backup:key:slot:add|replace|remove; key init takes
  --label and --delete-delay-days
- web UI: deletion delay and first slot at key creation, slot management,
  trash per location with restore; all behind password confirmation
- README: key, slots (safe / CTO / head of IT), and protection against
  ransomware: object lock in compliance mode (e.g. 90 days), credentials
  without delete rights, provider snapshots, off-site copy

tests/Unit/Crypto/KeyRingTest.php

@@ -33,4 +33,19 @@ class KeyRingTest extends TestCase {
 		$this->expectException(\InvalidArgumentException::class);
 		new KeyRing('short');
 	}
+
+	public function testAnySlotOpensTheSameKey(): void {
+		$keys = KeyRing::generate();
+		$field = ['slots' => [
+			['slot' => 1, 'label' => 'Safe', 'key' => $keys->wrap('passphrase in the safe')],
+			['slot' => 2, 'label' => 'CTO', 'key' => $keys->wrap('passphrase of the cto')],
+			['slot' => 3, 'label' => 'Head of IT', 'key' => $keys->wrap('passphrase head of it')],
+		]];
+		foreach (['passphrase in the safe', 'passphrase of the cto', 'passphrase head of it'] as $p) {
+			$this->assertSame($keys->blobId('x'), KeyRing::unwrapAny($field, $p)->blobId('x'));
+		}
+		$this->assertSame($keys->blobId('x'), KeyRing::unwrapAny($keys->wrap('legacy single'), 'legacy single')->blobId('x'));
+		$this->expectException(CryptoException::class);
+		KeyRing::unwrapAny($field, 'nobody knows this');
+	}
 }