Use built-in hardware encryption of NVME, SSD, or HDD drives

Currently encryption is optionally available at the 'GPFS layer':

* https://www.ibm.com/docs/en/spectrum-scale/5.1.0?topic=administering-encryption

While this may be useful, there is a lot of overhead in setting it up and maintaining it. Meanwhile many drives of various flavours (NVMe, SSD, HDD) support encryption via the firmware:

* https://www.ibm.com/docs/en/psfa/7.2.1?topic=administration-about-self-encrypting-drives
* https://www.ibm.com/docs/en/i/7.4?topic=nvme-concepts
* https://trustedcomputinggroup.org/wp-content/uploads/Architects-Guide-Data-Security-Using-TCG-Self-Encrypting-Drive-Technology.pdf

The GPFS software could query the drive(s) about capabilities, and if they support encryption (SED: self-encrypting drives), generate a random key to send to the drive so that all future I/O is scrambled. The encryption key is associated with the drive's serial number; it can be stored on the storage servers under (e.g.) /var/mmfs. This would not protect the entire server being stolen, but if drive leaves the data centre (replacement, retirement) then they will not be easily readable, especially if the contents of /var/mmfs are wiped on server decommissioning. 

The security would also not impact performance, as this encryption would be done a 'wire speed' by the drives themselves, instead of the CPUs, as is probably the case with encryption at the 'GPFS layer'. This option could be either 'opportunistic' (use it whenever a drive advertises support; otherwise keep going) or 'mandatory' (only allow use of drives with the capability; reject use of drives that do not).

'GPFS layer' encryption would still be useful as it allows for more flexible policies.