Adapt Keystore logic to be compatible with fips mode

[simitt]

Problem Description

In elastic/beats#42846 the keystore was removed from beats for ensuring functionality problematic for fips is not pulled into the beats binaries. This was a stop gap solution, but ideally the keystore implementation would be adopted to be usable in fips mode.

Goal

Review the keystore implementation and adapt implementation to be compatible with fips mode.
Initial stab in #277

[michel-laterman]

Switch to using NewGCMWithRandomNonce was done in #302, but that change will need to be revered due to how microsoft/go interacts with aes.Block