feat: decrypt Jasypt values in .env and Spring files

ENC(...) values are decrypted on reveal, copy or get with
jasypt-spring-boot's default algorithm (3.0+, PBEWITHHMACSHA512ANDAES_256).

- The password is, as in Spring, $JASYPT_ENCRYPTOR_PASSWORD, else the
  file's own jasypt.encryptor.password (JASYPT_ENCRYPTOR_PASSWORD in a
  .env), with ${VAR} and ${VAR:default} read from the environment.
- Errors say which password was used, or which one is missing.
- Secrets show a detail after their name: jasypt, or reference for a
  Spring ${VAR}; also in Go to and Favourites.
- A .env whose values are all Jasypt isn't marked as plain text in git.

internal/provider/repo/details.go

@@ -2,6 +2,8 @@ package repo
 
 import (
 	"context"
+	"fmt"
+	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
@@ -22,8 +24,8 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	}
 	var out []provider.Attr
 	meta, isSops := readMeta(c.ID)
-	// A plain file's values are at risk in git; a Spring file's only when
-	// one of its secrets is in plain text.
+	// A plain file's values are at risk in git, unless they're all Jasypt;
+	// a Spring file's only when one of its secrets is in plain text.
 	plain := !isSops
 	if !isSops && IsSpring(c.ID) {
 		out, plain = p.springDetails(c)
@@ -40,7 +42,7 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 			out = append(out, provider.Attr{Label: "encrypted", Value: meta.modified.Local().Format("2006-01-02 15:04")})
 		}
 	} else {
-		out = append(out, provider.Attr{Label: "encryption", Value: "none: plain text"})
+		out, plain = envDetails(c.ID)
 	}
 
 	git := func(args ...string) (string, bool) {
@@ -65,3 +67,28 @@ func (p *Provider) Details(ctx context.Context, c provider.Container) ([]provide
 	}
 	return out, nil
 }
+
+// envDetails says how a plain env file's values are encrypted, and whether
+// any is in plain text.
+func envDetails(file string) (attrs []provider.Attr, plain bool) {
+	b, err := os.ReadFile(file)
+	if err != nil {
+		return []provider.Attr{{Label: "encryption", Value: err.Error(), Warn: true}}, true
+	}
+	keys, _ := parseKeys(file, b)
+	n := 0
+	for _, k := range keys {
+		if k.jasypt {
+			n++
+		}
+	}
+	return []provider.Attr{{Label: "encryption", Value: jasyptShare(n, len(keys))}}, n < len(keys)
+}
+
+// jasyptShare is how many of a plain file's values are Jasypt's.
+func jasyptShare(n, of int) string {
+	if n == 0 {
+		return "none: plain text"
+	}
+	return fmt.Sprintf("jasypt: %d of %d values", n, of)
+}