SafeEncryptWithContext should use EncryptWithLabel

[TWal]

MLS defines the safe-ish SignWithLabel, ExpandWithLabel, EncryptWithLabel etc, and the safe API relies on it:

• SafeSignWithLabel uses SignWithLabel
• DeriveExtensionSecret uses ExpandWithLabel

However SafeEncryptWithContext doesn't use EncryptWithLabel and operate directly with HPKE.SealBase. Is there a technical reason for this?

I think it should use EncryptWithLabel to ensure proper domain separation with HPKE uses in the MLS RFC. Otherwise, we must ensure that MLS' EncryptContext and Safe API's LabeledExtensionContent cannot be serialized to the same bytestring (to follow the secure formatting rules of the Comparse paper). The latter fact seems to hold, under the condition that LabeledExtensionContent.label uses a QUIC-style length encoding (which is not clear because it is written as opaque label and not opaque label<V>). Using EncryptWithLabel would make that fact straightforward.