[SCHEMA] Optionally encrypt database secrets.

Summary:
This is the "secrets-only" part of D462, split out from the block-storage
stuff. Notable changes from the original revision:
 * Only encrypt secrets when the ENCRYPT_SECRETS config value is set.
 * Remove hook to cascade soft-deletion from accounts to secrets. I don't
   think we need this facility right now.
 * Do EAS schema migration before encryption migration.
 * Split encryption migration into several smaller parts for sanity.

Test Plan:
1. Auth all test accounts using old schema
2. Run migrations
3. Ensure that account credentials still work
4. Delete and reauth all accounts using new schema
5. Ensure that account credentials are stored and retrieved correctly.

Do this with config['ENCRYPT_SECRETS'] set to both True and False.

Reviewers: dlitz

Subscribers: dlitz

Differential Revision: https://review.inboxapp.com/D484

Conflicts:
	tests/general/test_vault.py