Only get passkey if actually required

Only get passkey if actually required

Getting passkey is not required when `encrypt` is run on a file where all variables are already encrypted, or `decrypt` is run on a file where all variables are already decrypted.

Previously, the passkey flow would always initiate. Now, it will only initiate the first time it is required.

This change improves the UX in situations where `encrypt` or `decrypt` are called on a continuous basis. For example, when calling `envpass encrypt` in a `prestart` npm script hook.