Key returns the cache key of a digest in the namespace of one organization
and one backend. The secret reference is hashed so its path never appears in
the shared store.
New creates an existence cache, backed by NATS KV when rc is set and by an
in-memory LRU otherwise. A NATS bucket that can not be set up falls back to
memory: the cache only makes uploads faster, so it must not stop its caller
from starting.