OTA: require encryption with the api key, plaintext + password only for migration

allow_plaintext_upload lets the uploader give a device that doesn't encrypt
yet its one migration install. Remove it together with the password once
every device has been updated (the uploader says so).

common/ota.yaml

@@ -2,3 +2,7 @@
 ota:
   - platform: esphome
     password: !secret ota_password
+    # migration to encrypted OTA (api key): once every device encrypts,
+    # remove allow_plaintext_upload together with the password
+    encryption:
+      allow_plaintext_upload: true