Migrate encrypted variables to new algorithm

we're currently using outdated, insecure and recommended-against settings for encrypting CI variables.

Context:

A bug was discovered in Encryptor v2.0.0 that incorrectly set the IV when using an AES-*-GCM algorithm.

We should look into migrating those to the recommended encryption algorithm. This won't be straightforward since we need to decrypt the current values with the old version of the encryptor then re-encrypt everything with the new settings and encryptor. This would need to happen in a background migration.

Instructions for upgrading to attr-encrypted v3.0.0 - https://github.com/attr-encrypted/attr_encrypted#upgrading-from-attr_encrypted-v2x-to-v3x

Instructions for upgrading to Encryptor v3.0.0 - https://github.com/attr-encrypted/encryptor#upgrading-from-v200-to-v300