Add extension servers for DEK wrap/unwrap

[pseudomuto]

An extension server is an operator-run gRPC server implementing
api.kms.v1.EncryptionService (in Temporal Proxy). Essentially it wraps
and unwraps the data encryption keys the proxy seals payloads with. It
is how an operator plugs in a key backend the proxy has no driver for,
such as an on-prem HSM, and mirrors what Temporal Proxy already offers.

Extension servers are declared once at the top level rather than per
cluster connection, so a single KMS backing several connections is
possible. A key policy reaches one through an "extension://"
URI.

Connecting stays lazy, so an unreachable server surfaces on first use
rather than at startup. Nothing constructs these yet, since
NewClusterConnection still ignores EncryptionConfig.

# Sample config
extensionServers:
  - name: hsm
    address: 127.0.0.1:9443
    tls:
      caServerName: hsm.internal

clusterConnections:
  - name: a
    encryption:
      enabled: true
      default:
        uri: extension://hsm/replication
        duration: 1h
        renewBefore: 15m