fscrypto: only allow setting encryption policy on directories