Issue 413: Encrypt sensitive data in the clinics table

[mercedesb]

I rule and have completed some work on Case Manager that's ready for review!

This PR encrypts sensitive clinic data at-rest.

This pull request makes the following changes:

• Configures deterministic encryption to support cases where that's required (like when we want to have uniqueness validation)
  • You'll want to set an env var in production for ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY prior to running the post-deploy rake task
• Encrypts sensitive clinic columns
• Adds post-deploy rake task to encrypt existing clinic data
  • run rails clinic:encrypt_sensitive_columns after you deploy this branch
  • if you run a select query on the clinics table in production, you should see both a bunch of the columns are encrypted

It relates to the following issue #s:

• Bumps Use attr_encrypted or symmetric_encryption for protecting sensitive data at rest? #413

For reviewer:

• Adjust the title to explain what it does for the notification email to the listserv.
• Tag this PR:
  • feature if it contains a feature, fix, or similar. This is anything that contains a user-facing fix in some way, such as frontend changes, alterations to backend behavior, or bug fixes.
  • dependencies if it contains library upgrades or similar. This is anything that upgrades any dependency, such as a Gemfile update or npm package upgrade.
• If it contains neither, no need to tag this PR.

[mercedesb]

coordinates is probably a sensitive column but it's a decimal array field so out-of-the-box ActiveRecord encryption doesn't totally work. Let me know if you'd like me to spend some time on a small custom solution so we can encrypt non-string fields (I'd do that work in a separate PR)

[colinxfleming]

Does what it says on the tin! Nice work again. I've also added the new env var to our staging and prod environments.

I think encrypting coordinates is good if we can swing it. I'm willing to change the datatype for that column if it's helpful though that's obviously a bit more involved. If you want to tackle it, whip up an issue for it I think?

thanks much @mercedesb !