Target secrets support

[ramaro]

Introduces a new feature of "target secrets".

Secrets are originally standalone but dealing with them at scale can become complicated, especially when one needs to add or remove recipients. The proposed solution is to organise secrets per target in their respective target directory (inside --secrets-path).

For the recipients below in the inventory for my-target:

...
target_name: my-target
kapitan:
  secrets:
    recipients:
      - name: person1@example.com
        fingerprint: DEADBEEF
      - name: person2@example.com
        fingerprint: 8BADF00D

Creating a secret for target my-target:

$ kapitan secrets --write targets/my-target/secret_sauce -t my-target -f my_data
Wrote secret targets/my-target/secret_sauce for fingerprints DEADBEEF, 8BADF00D at ./secrets/targets/my-target/secret_sauce

Let's suppose person1@example.com is no longer part of the recipients for my-target.

First we need to validate by specifying were my target secrets were written:

$ kapitan secrets  --validate-targets --secrets-path ./secrets/targets/
my-target/secret_sauce recipient mismatch

And then fix the recipient mismatch:

$ kapitan secrets  --update-targets  --secrets-path ./secrets/targets/
Wrote secret  my-target/secret_sauce for fingerprints 8BADF00D at .../secrets/targets/my-target/secret_sauce

Now that the secrets are updated, I can recompile and should see changes in whatever items are using secret targets/my-target/secret_sauce