Function encrypt_provider_token_bound 

pub fn encrypt_provider_token_bound(
    key: &TokenEncryptionKey,
    plaintext: &str,
    aad: &[u8],
) -> Result<String, AuthError>

Encrypt a provider refresh token with AAD binding it to its row identity.

Returns "enc2:<base64url(nonce||ciphertext)>". The same aad bytes must be supplied to decrypt_provider_token_bound; a ciphertext moved to a row with a different identity fails decryption.