Memoize decryption attempts

Now that we no longer rely on the sandbox's shared `Subject`, the security policy consults the `KeyChain` directly, which was causing its kernel to be decrypted on demand rather than once on startup and again when replaced due to a keychain modification. This is an expensive operation and was slowing the OT down. So I added a memo to cache decryption attempts, which speeds things up quite a bit.