Document encryption standards for encryption at rest

[rmccue]

We encrypt our data at rest with KMS keys; there's two keys backed by HSMs, one per customer and one per environment. These use SYMMETRIC_DEFAULT which is AES-256-GCM.