Add support of encrypted payload for Cloud Device API

[gcatanese]

Summary

This PR adds support for encrypted payloads in the Cloud Device API, enabling end-to-end encryption for terminal communication.

Changes

New service

• EncryptedCloudDeviceApi — support sending and receiving encrypted payloads

New models

• CloudDeviceApiSecuredRequest / CloudDeviceApiSecuredResponse — wrappers for encrypted request/response payloads
• SaleToPOISecuredMessage — represents a secured (encrypted) Sale-to-POI message
• clouddevice/security/NexoDerivedKey — derived key model used in the encryption scheme
• clouddevice/security/SecurityTrailer — security trailer attached to encrypted messages

New security utilities

• EncryptionCredentialDetails — holds the encryption credential configuration
• NexoCryptoPrimitives — low-level crypto primitives (AES, HMAC, etc.)
• NexoDerivedKeyGenerator — derives session keys from a master key
• NexoSecurityException — dedicated exception for security/encryption errors
• NexoSecurityManager — orchestrates encryption and decryption of Cloud Device API messages

Tests

• NexoSecurityManagerTest — unit tests for the encryption/decryption logic
• EncryptedCloudDeviceApiTest — integration-style tests for the full encrypted request/response flow, backed by fixture JSON files

[gemini-code-assist]

Code Review

This pull request implements end-to-end encryption for the Cloud Device API, introducing models and logic for Nexo-compliant secured messages. Key additions include the NexoSecurityManager for AES-256-CBC encryption and HMAC-SHA256 integrity checks, along with new CloudDeviceApi methods for synchronous and asynchronous encrypted requests. Feedback highlights a security risk in the 'Decrypt-then-MAC' implementation, performance concerns regarding repeated key derivation and ObjectMapper instantiation, and the use of weak PBKDF2 parameters for key generation.