Storage: encrypt files before the first write, with no size cap

Summary Turning on encryption for a bucket doesn't always encrypt files the way you'd expect. Big files are skipped, and small files get stored first and only encrypted afterwards. This issue proposes encrypting every chunk as it arrives, for files of any size, while making uploads cheaper rather than more expensive. What happens today Three things stand out: • Files over 20 MB are never encrypted, even with encryption on. Encryption works on the whole file at once, so it has to fit in memory, and 20 MB (APP_STORAGE_READ_BUFFER) is the limit. • Small files are stored, then encrypted. The upload is saved to storage as-is, read back, encrypted and saved again. That's an extra read and write on every encrypted upload, and until the second write the stored file isn't encrypted. • Encrypted files are costly to read. They're stored as base64, about a third bigger than the original. Every range request (seeking in a video, resuming a download) h…