Is this a BUG REPORT or FEATURE REQUEST?:
/kind feature
/sig auth

What happened:
Currently encryption config parsing uses a non-standard parsing method that pays no attention to the version of the config:

What you expected to happen:

• the types must change to use standard methods for including kind/apiVersion (inlining metav1.TypeMeta like all other objects)
• define a versioned config (we can promote straight to v1beta1 if we don't require any structural changes)
• parsing must require well-formed config files

Anything else we need to know?:
Requested by @liggitt and extracted from #61592 (comment)

Steps to be done:

• fix type definition to actually be a runtime object, inline TypeMeta, etc
• define v1beta1 API types, generate conversions/defaults
• define scheme/codecs that have the external (v1beta1) and internal (existing) types registered
• use that scheme/codec to load the config (handles decoding the v1beta1 version, conversion to internal version)

CC @marrrvin