Only call uncrypt when we're encrypted

We were always generating a block map for encrypted update, even
when the device was not encrypted.  This leads to a spectacular
failure.  Fix this by only calling uncrypt when we're encrypted.

Additionally, only pass block.map as the update file in the case
that the device was encrypted and requires it.

NIGHTLIES-3012
Change-Id: Ia34eb5115ac4365605fd57f76179854a6042c5e4