Encrypt trigger kwargs on first read, if not already encrypted yet

[jedcunningham]

Description

If there are triggers running when an offline migration happens to 2.9.0+, the trigger kwargs aren't encrypted. We've added logic to notice this and return the value before trying to decrypt it in #39246.

However, we deferred the work of doing that encryption when the first read happens. It'd be useful to do that so the existing triggers get encrypted when the triggerer picks them up.

Use case/motivation

No response

Related issues

No response

Are you willing to submit a PR?

• [ ] Yes I am willing to submit a PR!

Code of Conduct

• [X] I agree to follow this project's Code of Conduct