S3A CSE: minor tuning

Some minor tuning to the CSE encryption support before backporting to 3.3.x and so shipping this year

• LogExactlyOnce an "please ignore the warning" message to a new log ("org.apache.hadoop.fs.s3a.encryption") which can be set to ERROR if you get bored of the message.

• Extend testing_s3a.md and the SDK upgrade runbook: test CSE always

• change property name of encryption key (maybe: fs.s3a.encryption) and add mapping in S3AFileSystem.addDeprecatedKeys ... docs will need updating too.