add docs for AES-CBC

Author: rculpepper

content/vault/v1.21.x/content/api-docs/secret/transit.mdx

@@ -70,6 +70,8 @@ values set here cannot be changed after key creation.
   - `aes256-cmac` - AES-256 CMAC (CMAC generation, verification) <EnterpriseAlert inline="true" />
   - `ml-dsa` - ML-DSA (asymmetric) (experimental) <EnterpriseAlert inline="true" />
   - `hybrid` - hybrid signatures combining a post-quantum algorithm and an elliptic curve algorithm (asymmetric) (experimental) <EnterpriseAlert inline="true" />
+  - `aes128-cbc` - AES-128 in CBC mode (symmetric, supports derivation and convergent encryption)
+  - `aes256-cbc` - AES-256 in CBC mode (symmetric, supports derivation and convergent encryption)
 
   ~> **Note**: In FIPS 140-3 mode, the following algorithms are not certified
      and thus should not be used: `chacha20-poly1305`.
@@ -890,6 +892,12 @@ will be returned.
   decrypt) could be indicative of a security breach and should not be
   ignored.
 
+- `iv` `(string: "")` - Specifies the **base64-encoded** IV value to use with
+  AES-CBC. The value must be exactly 128 bits (16 bytes) long and the user must ensure that
+  for any given context (and thus, any given encryption key) this IV value is
+  **never reused**. If not provided, a random IV will be generated and prepended
+  to the ciphertext.
+
 ~>**NOTE:** All plaintext data **must be base64-encoded**. The reason for this
 requirement is that Vault does not require that the plaintext is "text". It
 could be a binary file such as a PDF or image. The easiest safe transport