Encryption: Refine secrets-related commands (#45201) (#45790)

* CLI: Adjust 're-encrypt-data-keys' command

* CLI: Adjust 're-encrypt' command

* Multiple improvements on re-encrypt secrets migration

* Another bunch of code improvements

* Lint fixes

(cherry picked from commit e6a85826e9)

Co-authored-by: Joan López de la Franca Beltran <5459617+joanlopez@users.noreply.github.com>

pkg/services/secrets/manager/manager.go

@@ -48,7 +48,7 @@ func ProvideSecretsService(
 
 	logger := log.New("secrets")
 	enabled := features.IsEnabled(featuremgmt.FlagEnvelopeEncryption)
-	currentProviderID := normalizeProviderID(secrets.ProviderID(
+	currentProviderID := kmsproviders.NormalizeProviderID(secrets.ProviderID(
 		settings.KeyValue("security", "encryption_provider").MustString(kmsproviders.Default),
 	))
 
@@ -79,14 +79,6 @@ func ProvideSecretsService(
 	return s, nil
 }
 
-func normalizeProviderID(id secrets.ProviderID) secrets.ProviderID {
-	if id == kmsproviders.Legacy {
-		return kmsproviders.Default
-	}
-
-	return id
-}
-
 func (s *SecretsService) registerUsageMetrics() {
 	s.usageStats.RegisterMetricsFunc(func(context.Context) (map[string]interface{}, error) {
 		usageMetrics := make(map[string]interface{})
@@ -330,7 +322,7 @@ func (s *SecretsService) dataKey(ctx context.Context, name string) ([]byte, erro
 	}
 
 	// 2. decrypt data key
-	provider, exists := s.providers[normalizeProviderID(dataKey.Provider)]
+	provider, exists := s.providers[kmsproviders.NormalizeProviderID(dataKey.Provider)]
 	if !exists {
 		return nil, fmt.Errorf("could not find encryption provider '%s'", dataKey.Provider)
 	}