FileCredentialsImpl is weird. Definitely not a generally supported usage of @DataBoundConstructor. You cannot and should not attempt to export a FileItem; it is just there to handle browser file uploads. From the perspective of JCasC, ignore the file parameter and use only fileName + secretBytes (the things you actually have getters for anyway).
You may need to be adding SecretBytes support to JCasC for the first time. Created by Stephen Connolly. AFAIK used only by FileCredentialsImpl and CertificateCredentialsImpl.
To be clear, I do not believe any patch to plain-credentials is possible, at least without a rewrite of file uploads in Stapler. configuration-as-code is just going to have to deal with what is there.