repo-updater: init encryption and decrypt external service on read

Created by: unknwon

Previously, we only init encryption on frontend (for read and write), which breaks all read paths for repo-updater.

Part of #14644 (closed)