Handle Tool Configuration credential storage in the model layer - #15608

Encryption lived in the edit view, so the create views, the REST serializer,
the admin and loaddata all stored the credential as it was typed, and api_key
was never encrypted by anything. Moving it into the model field covers every
writer and every reader, and drops the manual calls at the two sites that had
them.

Because reads no longer go through prepare_for_view, a value stored before this
change is returned as it is rather than as an empty string, so opening and
saving an affected configuration stops discarding its password and SSH key.

The columns become text: AES-GCM output is a little over twice the input, which
did not fit the old widths. The migration encrypts the rows already stored.