Make the tests fast under the race detector (closes #120)

Deriving keys from passphrases with scrypt, slow on purpose, took most
of the test time under -race. secret.ScryptWorkFactor, when not zero,
replaces age's work factor when a passphrase encrypts; the tests of
internal/secret, internal/vault and internal/cli set it to 1 in
TestMain, and the program never sets it. TestGetCommandOutputsToStdout
checks that the built binary's passphrase unlocker names age's 18.

TestRemovalAsksWithoutHoldingLock and TestFailedCommandReleasesLock
time the in-memory lock all tests share, so they no longer run in
parallel. TestConcurrentAddsKeepEveryVersion and
TestGetCommandOutputsToStdout time nothing and now do.

The script/cibuild comment no longer says tests are skipped without
its memlock ulimit.

Model: opus-5-5

internal/secret/crypto.go

@@ -28,6 +28,17 @@ var (
 // terminal to read the mnemonic from, reading it failed, or it was empty.
 var ErrMnemonicNotRead = errors.New("failed to read mnemonic")
 
+// ScryptWorkFactor is, when not zero, the scrypt work factor that
+// EncryptWithPassphrase uses instead of age's, 18: log2 of scrypt's cost
+// parameter N. Deriving a key with age's takes about a second and 256 MiB, on
+// purpose, since so does every guess at the passphrase. Only tests set it,
+// lower, before any test runs, so that the passphrase unlockers they create
+// cost nothing; the program leaves it zero. Decryption takes the work factor
+// from the encrypted data, so it needs no setting.
+//
+//nolint:gochecknoglobals // set by the tests of the packages that use this one
+var ScryptWorkFactor int
+
 // EncryptToRecipient encrypts data to a recipient using age
 // The data parameter should be a LockedBuffer for secure memory handling
 func EncryptToRecipient(
@@ -142,6 +153,10 @@ func EncryptWithPassphrase(
 		return nil, fmt.Errorf("failed to create scrypt recipient: %w", err)
 	}
 
+	if ScryptWorkFactor != 0 {
+		recipient.SetWorkFactor(ScryptWorkFactor)
+	}
+
 	return EncryptToRecipient(data, recipient)
 }
 

internal/secret/secret_test.go

@@ -25,6 +25,14 @@ var (
 	errNotImplementedInMock = errors.New("not implemented in mock")
 )
 
+// TestMain makes passphrase encryption in the tests cheap; see
+// ScryptWorkFactor.
+func TestMain(m *testing.M) {
+	ScryptWorkFactor = 1
+
+	os.Exit(m.Run())
+}
+
 // MockVault is a test implementation of the VaultInterface
 type MockVault struct {
 	name            string