Add a "WithoutEnvelope" option to wrappers for raw Encrypt/Decrypt support

[sgmiller]

By default many of the wrappers use Envelope encryption during
encrypt/decrypt. This is helpful for the common case like seal wrapping
where we want to support arbitrary sized plaintexts without worrying about
the underlying cipher's limits. However, these days, wrappers are used as a
general interface for external cryptography. Some features, like PKI
signing, require more low level operations. An example is SCEP, which uses
the CA private key for encryption and decryption as well. Another
is Transit managed keys, which support cryptographic primitive operations
that may need to interact with other systems. In these cases we need the
simple encrypt/decrypt without an envelope.

This PR adds a new global wrapper option, WithoutEnvelope(), which if
present requests that the wrapper use direct encryption/decryption.

PCI review checklist

• I have documented a clear reason for, and description of, the change I am making.

• If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.

• If applicable, I've documented the impact of any changes to security controls.

  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.