make encryption stream wrapper seekable

Rewrite of #8390.
There's a lot of stuff fixed, such as support for reads that are not exactly 6126 bytes, the encrypted file size pushed to fileinfo, but most importantly it makes encrypted streams seekable (if the storage is seekable). Main purpose is to serve http range requests well. Note that #10422 must be reversed to support http range requests on encrypted streams.
A main change is that stream_read and stream_write operate on an unencrypted cached block, with all file readings/writings handled by flush and readCache, which is where encryption/decryption happens.