Add validation to require encrypted assertions

[camsaul]

No description provided.

[dbrrr]

See #34

Note that, because we dispatch on each of the validation keywords, and because we perform this dispatch after decryption, we need to either A) add some "pre-decryption validators" which can be run against each Assertion/against the Response or B) take the approach I've done which is to manually check the config and run checks against it.

Further, note that, in order to keep the API config consistent, I made the flag a member of :assertion-validators. However, we don't actually want to dispatch on this keyword for the reason above. I added a function move-validator-config which extracts this keyword and adds it to the top-level of the config map, so that we can both make validation decisions pre-decryption and also not try to dispatch on the keyword.

There may be a better way to handle this, but I'm not sure if it merits "pre-decryption" validators, given that we may only want to perform this one-off check