Add support for truncated matched data.

Includes breaking changes to the decrypt subcommand:

• The encrypted matched data argument is now a positional argument.
• Both the encrypted matched data and private key arguments now expect a
  filename. Passing - as the positional argument leads to the data data being read from stdin.
• The argument --private-key-stdin has been removed.

Removes support for matched data blobs with version 2.

Decrypts matched data blobs with the new version 3.
Also supports existing version 2.

Decrypts matched data blobs with the new version 2.

Initial version.