Salted Namefilters

[matheus23]

Today you can binary-and a subset or all namefilters in the private filesystem without access to read keys. This can reveal some information.

We should instead just add a public salt to namefilters and use that salt when hashing for its indices. This makes it very unlikely that the binary and of two namefilters has meaningful information, since most likely their salts are different & that completely scrambles them.

We also use namefilters as a consistent naming scheme - sort of like a pointer machine. So we need to make sure that we keep having consistent namefilters for newer revisions. We can't re-use the same salt for all versions, but we can derive some uniformly random salt from the internal ratchet.

[expede]

Also credit where due: thanks to @Stebalien for the suggestion 🎉

[matheus23]

Oh yeah right! Totally! I meant to add that and just forgot. Thanks Steb :)