database: Route all encryption/decryption calls through standard helper functions

Created by: efritz

Extracted from #39984. This PR should be a behavior-preserving consolidation of encryption/decryption calls from the database layer through a central point in the internal/encryption package.

In the future I plan to make an abstraction that allows background encryption/decryption of such records (see PR linked earlier). This refactoring is a pre-step to ensure that encrypted writes can be turned off while decryption is occurring.

Update:

A few PRs have been merged into this branch so we have a single merge commit to revert if something goes wrong.:

• https://github.com/sourcegraph/sourcegraph/pull/40062
• https://github.com/sourcegraph/sourcegraph/pull/39984

Test plan

Exiting and modified unit tests.