Function decrypt_data_owned 

pub fn decrypt_data_owned(
    data: Vec<u8>,
    key_hex: &str,
    nonce_hex: &str,
) -> Result<Vec<u8>, String>

decrypt_data in place, for a caller that owns the ciphertext: the plaintext comes back in the same allocation, so nothing the size of the file is copied.