Rework the Volume Encryption admin-guide section to describe the offering-based
enablement (an encrypted Disk/Compute Offering) as the primary mechanism, with
KMS as an optional passphrase-wrapping layer rather than the only path. Add the
supported primary-storage backends and the Ceph/RBD librbd LUKS2 specifics: thin
provisioning, copy-on-write encrypted root clones, the libvirt >= 10.1.0 hot-plug
requirement, and the KVM host requirements.

Encrypted Ceph/RBD volumes require ceph-common (the rbd CLI) on every KVM
host - a dependency that non-encrypted RBD does not have, since normal RBD
I/O goes through libvirt+librbd. Call this out as an operational trade-off
versus the qemu-native LUKS stack, which needs no extra Ceph tooling.