Related to #90 and #91, in order for our encrypted helpers to function as drop-in replacements, we need to decrypt the contents of UnprocessedItems when we receive them in response to a batch_write_item operation.

In order to avoid hitting the CMP twice for every item, we should retain the plaintext key materials for use in processing the response, in the form of an ephemeral CMP that will be discarded once that request is handled.