Encrypt trigger kwargs on first read, if not already encrypted yet

### Description

If there are triggers running when an offline migration happens to 2.9.0+, the trigger kwargs aren't encrypted. We've added logic to notice this and return the value before trying to decrypt it in #39246.

However, we deferred the work of doing that encryption when the first read happens. It'd be useful to do that so the existing triggers get encrypted when the triggerer picks them up.

### Use case/motivation

_No response_

### Related issues

_No response_

### Are you willing to submit a PR?

- [ ] Yes I am willing to submit a PR!

### Code of Conduct

- [X] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)

Start by reading the encryption and compatibility logic described in issue #39246, then trace how the triggerer reads trigger kwargs. Implement first-read encryption only for values that are not already encrypted, and verify that existing encrypted values remain readable and are stored encrypted after the read.

Written by the indexing model from the issue text.