encryption: Lazily decrypt `batch_changes_site_credentials`
Created by: efritz
Stacked on #40282. This PR wraps the batch_changes_site_credentials.credential field in an encryptable struct.
Test plan
main-dry-run: https://buildkite.com/sourcegraph/sourcegraph/builds/166840