Iterate over ranges correctly for encryped files

Summary:
Fixes T12079. Currently, when a file is encrypted and a request has "Content-Range", we apply the range first, then decrypt the result. This doesn't work since you can't start decrypting something from somewhere in the middle (at least, not with our cipher selection).

Instead: decrypt the result, then apply the range.

Test Plan: Added failing unit tests, made them pass

Reviewers: chad

Reviewed By: chad

Maniphest Tasks: T12079

Differential Revision: https://secure.phabricator.com/D17623