crypto: move encryption & decryption into abstract "oracle" objects

Summary:
This will allow us to do more interesting key management.

This also decouples 096_migrate_secret_data.py from the oracle code so
that it doesn't break again the next time we change it.  (We shouldn't
be doing re-encryption inside an Alembic migration anyway.)

Test Plan:
- Ran the unit tests.
- Manually tested migrating the database from v0.3.0 (alembic rev
  2b89164aa9cd)

Reviewers: emfree

Reviewed By: emfree

Subscribers: dlitz

Differential Revision: https://review.inboxapp.com/D511