refactor: perform decrypt as part of merge renovate.json (#1086)

Also clarify docs that encrypted config must be contained in renovate.json (i.e. not package.json).