fix(ncu-config): allow overriding global encrypted keys with local ones (#1030)

If a value is defined locally, it should make no difference whether the
associated key is present or not in the global config.

Also fix a bug where the `additional` being ignored if config was
previously merged.

Author: aduh95

lib/config.js

@@ -25,9 +25,21 @@ export function getMergedConfig(dir, home, additional) {
     const globalConfig = getConfig(GLOBAL_CONFIG, home);
     const projectConfig = getConfig(PROJECT_CONFIG, dir);
     const localConfig = getConfig(LOCAL_CONFIG, dir);
-    mergedConfig = Object.assign(globalConfig, projectConfig, localConfig, additional);
+
+    // Using property descriptors to avoid calling any setter if e.g. a
+    // localConfig value overrides a globalConfig key.
+    mergedConfig = Object.create(null, {
+      ...Object.getOwnPropertyDescriptors(globalConfig),
+      ...Object.getOwnPropertyDescriptors(projectConfig),
+      ...Object.getOwnPropertyDescriptors(localConfig),
+    });
   }
-  return mergedConfig;
+  return additional
+    ? Object.create(null, {
+      ...Object.getOwnPropertyDescriptors(mergedConfig),
+      ...Object.getOwnPropertyDescriptors(additional),
+    })
+    : mergedConfig;
 };
 export function clearCachedConfig() {
   mergedConfig = null;