Annotate and consolidate use of encryption=None

Although metadata encryption makes the device encryption policy
redundant, for now it is still being used, and the rule is still that
every top-level directory in /data is encrypted by the device policy
unless there is a specific reason why the directory can't be encrypted.
There are various cases where encryption=None is legimately needed and
is used, but they aren't explained in the code, and the option is prone
to be copy-and-pasted (as was done in https://r.android.com/1932960).

Fix this by explicitly commenting every case where encryption=None is
used, and consolidating the creation of all the user parent directories
into one place.  (I left /data/bootanim as-is since it will be changed
to encrypted; see b/232299581.)

Change-Id: I6db5f4be7774e3d250c370638e8e7e33e226f3e7