Update ExternalService.Configuration() to decrypt the config json blob if it's encrypted.

Created by: arussellsaw

ref RFC 310

deps: #18053 (closed) #18049 (closed)

Before we can start encrypting external service config, we need to be confident that we're decrypting it everywhere. In order to do this we should first be decrypting the config blob on calls to Configuration, and also any other places where the raw json is accessed. This code should assume that the Key implementation will transparently pass unencrypted values without throwing an error.