encryption: Lazily decrypt `user_credentials`

Created by: efritz

Stacked on #40282. This PR wraps the user_credentials.credential field in an encryptable struct.

Test plan

main-dry-run: https://buildkite.com/sourcegraph/sourcegraph/builds/166841