Encrypted history sharing: design "key bundle" format

[richvdh]

Our proposed solution to sharing encrypted room history on invite involves uploading all of the room keys to an encrypted media blob.

This issue tracks the design of a format for that encrypted blob. Likely it will be based on the key export format, but also bear in mind that the key should be autogenerated (rather than derived from a passphrase) and will be shared over a to-device message (see #2689), so see the encrypted attachment format.

We have some ideas for security improvements over the current encrypted attachment format which we should implement too. In particular, we would like to address some of the points raised by the Missing Salamanders blog post.