Encryption: Cache new DEKs (only) after a caution period (#60664)

* Encryption: Cache new DEKs (only) after commit

* Fix typo

* Update secrets manager tests with new failing case

* Update secrets manager tests with new clarifications (comments)

* Correct broken method calls

* Unify methods

* Cache data keys only after a caution period

* Caution period for data keys caching only for encrypt ops

pkg/services/secrets/secrets.go

@@ -5,8 +5,6 @@ import (
 	"fmt"
 	"strings"
 	"time"
-
-	"xorm.io/xorm"
 )
 
 // Service is an envelope encryption service in charge of encrypting/decrypting secrets.
@@ -36,7 +34,6 @@ type Store interface {
 	GetCurrentDataKey(ctx context.Context, label string) (*DataKey, error)
 	GetAllDataKeys(ctx context.Context) ([]*DataKey, error)
 	CreateDataKey(ctx context.Context, dataKey *DataKey) error
-	CreateDataKeyWithDBSession(ctx context.Context, dataKey *DataKey, sess *xorm.Session) error
 	DisableDataKeys(ctx context.Context) error
 	DeleteDataKey(ctx context.Context, id string) error
 	ReEncryptDataKeys(ctx context.Context, providers map[ProviderID]Provider, currProvider ProviderID) error