aesGcmEncryptBytes(): Promise<AesGcmEncrypted>
AES-GCM encrypt with raw key bytes, using whichever implementation is faster for this payload.
webKey lets a caller that already holds (or caches) the matching Web Crypto
key hand it over instead of importing a fresh one; it is only called when the
payload is large enough to take the Web Crypto path.
Promise<AesGcmEncrypted>