[MASWE-0014] Add Cryptographic Keys Not Properly Protected at Rest

[cpholguera]

Closes to #2578

Add detailed sections to MASWE-0014.md for "Cryptographic Keys Not Properly Protected at Rest"

• Overview: Describe the weakness of storing cryptographic keys improperly at rest.
• Impact: Explain potential consequences, such as unauthorized access to sensitive data.
• Modes of Introduction: List common ways this weakness can be introduced.
• Mitigations: Provide recommendations for securely storing cryptographic keys.
• Remove the draft field from the metadata.
• Add status: new in the yaml metadata.
• Ensure references in the refs field are used inline in the markdown content.

[cpholguera]

TODO: Make sure the differences between

• MASWE-0005: Sensitive Data Hardcoded in the App Package
• MASWE-0013: Hardcoded Cryptographic Keys in Use
• MASWE-0014: Cryptographic Keys Not Properly Protected at Rest
• MASWE-0036: Authentication Material Stored Unencrypted on the Device

are very clear, or refactor them. Also have a potential weakness for the app not using the maximum protections, which should have profiles: [R]

For example:

• it may be worth splitting MASWE-0005 into:
  • Cryptographic Keys Hardcoded in the App Package
    • Use secure key management practices: Store cryptographic keys securely using platform-specific key management mechanisms, such as the Android Keystore or iOS Keychain.
    • Generate keys dynamically: Generate cryptographic keys at runtime instead of hardcoding them in the source code.
    • Implement key rotation: Regularly rotate cryptographic keys to minimize the impact of key exposure.
  • API Keys Hardcoded in the App Package or use MASWE-0036: Authentication Material Stored Unencrypted on the Device.
    • https://cloud.google.com/docs/authentication/api-keys#securing_an_api_key
    • https://cloud.google.com/docs/authentication/api-keys#adding_application_restrictions
  • Cryptographic Keys Not Properly Protected on Export?

The impact and mitigation for API keys hardcoded is very different than the one for crypto keys.