feat(protect): add support for deeply nested protect schemas

[calvinbrewer]

Added support for nested objects in Protect schemas, allowing you to encrypt and search on nested properties through the model interfaces. E.g.

import { csTable, csColumn, csValue } from "@cipherstash/protect";

export const protectedUsers = csTable("users", {
  email: csColumn("email").freeTextSearch().equality().orderAndRange(),
  profile: {
    name: csValue("profile.name"),
    address: {
      street: csValue("profile.address.street"),
      location: {
        coordinates: csValue("profile.address.location.coordinates"),
      },
    },
  },
});

When working with nested objects:

• Each level can have its own encrypted fields
• The maximum nesting depth is 3 levels
• Null and undefined values are supported at any level
• Optional nested objects are supported

[calvinbrewer]

The encrypt config will look like the following and the i -> column field in the EQL payload will have the dot notation as the column name to continue protection against confused deputy attacks. @CDThomas Is this the correct way to handle this?

{
  v: 2,
  tables: {
    users: {
      email: [Object],
      address: [Object],
      'example.field': [Object],
      'example.nested.deeper': [Object]
    }
  }
}

[CDThomas]

Left a few minor comments, but LGTM otherwise.

[CDThomas]

The column/attribute name in the DB table can't contain a . since we're using it a delimiter, right? Definitely an edge case, but thought it was worth mentioning.

[CDThomas]

The encrypt config will look like the following and the i -> column field in the EQL payload will have the dot notation as the column name to continue protection against confused deputy attacks. @CDThomas Is this the correct way to handle this?

{
  v: 2,
  tables: {
    users: {
      email: [Object],
      address: [Object],
      'example.field': [Object],
      'example.nested.deeper': [Object]
    }
  }
}

This makes sense to me @calvinbrewer. I think the main thing we want to do on the client at the moment is to only decrypt the specific fields that have been configured as encrypted (as opposed to blindly decrypting anything that looks like a ciphertext).