Optionally encrypt database secrets.

This is the "secrets-only" part of D462, split out from the block-storage
stuff. Notable changes from the original revision:
 * Only encrypt secrets when the ENCRYPT_SECRETS config value is set.
 * Remove hook to cascade soft-deletion from accounts to secrets. I don't
   think we need this right now.
 * Do EAS schema migration before encryption migration.
 * Split encryption migration into several smaller parts.