This has been bugging me for years. Up until now, whether we need to
decrypt the stream before decompressing it or not, we've been passing
everything through some form of decryption class. In the _vast_ majority
of cases this will be a `NullDecrypter`, which simply passes data through
it untouched. This is fine, but it is still another link in the chain,
adding overhead and the potential for things to go wrong. On top of this,
decryption does need a couple of extra steps which are managed by the
`DecryptedIo` class. Again, fine, but this adds complexity that isn't
needed in the _vast_ majority of cases and `DecryptedIo` has got more
complex recently with the addition of AES decryption.

So this commit changes how we build our IO pipeline within `InputStream`
and only uses decryption, and therefore `DecryptedIo`, when we are
actually decrypting something.

Fixes rubyzip#647