refactor(keystore): Enable concurrent access for SafeSecretKey and SecureRandomKeyProvider

[harrytmthy]

Summary

This PR enables concurrent access to key material in both SafeSecretKey and SecureRandomKeyProvider, aligning with the goals of #26. While both classes were technically thread-safe via synchronized blocks, they did not scale well in concurrent environments, blocking all threads during common operations like getOrCreateKey() or getEncoded().

---

Implementation Details

✅ SecureRandomKeyProvider

• Replaces decryptedKey with an AtomicReference<SecretKey>.
• Moves the early get() check outside the synchronized block.
• Rechecks the atomic value inside to avoid duplicate construction.

✅ SafeSecretKey

• lastCopy is now an AtomicReference<ByteArray>.
• The XOR-masked value is now unmasked before being stored in lastCopy (fix for Issue Enhance SafeSecretKey with XOR-based in-memory masking for stronger runtime security #23).
• Shrinks the synchronized scope in getEncoded() and reattempts the early return inside the lock.
• Replaces maskBuffer with a simple heap-stored mask, allowing safe concurrent reads without locking the buffer.

---

Closes

• Enable concurrent key access for both SecureRandomKeyProvider and SafeSecretKey #26