decrypt_kv jinja filter fails if the key isn't in the kv store

An action file that has a secret parameter with a default value as follows:

action_param:
  type: string
  description: "This will fail the action"
  default: "{{ st2kv.system.test_param | decrypt_kv }}"
  secret: true

will fail with the following message if 'test_param' is not in the kv store:

ERROR: 400 Client Error: Bad Request
MESSAGE: Failed to render parameter "test_param": Referenced datastore item "st2kv.system.test_param" doesn't exist or it contains an empty string

Alternatively, if I pass a value that doesn't exist in the kv store but I don't try to decrypt it, then a blank string gets passed into the action parameter. I would expect an encrypted value to pass a blank string as well instead of failing.

Locate the decrypt_kv Jinja filter and the parameter-rendering path that handles missing datastore values. Reproduce the action parameter case described in the issue, then add coverage for a missing key and confirm that the encrypted form passes an empty string instead of failing.