encryption: Lazily decrypt `external_services`

Created by: efritz

Stacked on #40282. This PR wraps the external_services.config field in an encryptable struct.

Test plan

main-dry-run: https://buildkite.com/sourcegraph/sourcegraph/builds/166845