Overridable secret key, with simple hiera integration

The function now takes either a string (in which case it continues to use the master key) or a hash containing the value to decrypt and the secret key to use.

This makes a layered approach to security easier (e.g.: different secrets for web/app vs app/db) and integrates simply with hiera.