Fix filter behavior to show pre-rekey diffs properly

After a rekey, diffs were just blank and confusing. This removes the
built-in requirement for the filters to succeed, but allows more
visibility into the encryption and decryption process. Before, we were
cheating by handling a failure case in the helper scripts, which wasn't
actually beneficial. Now, pre-rekey diffs show the original ciphertext
and indicate that the smudge filter failed to decrypt the old files.

To get these improved filter commands, users will have to flush
credentials and then reconfigure transcrypt.