Vault (ie. encryption) functionality

As hinted-to and dicsussed on the mailing-list, I'm adding a "vault" (thanks to @vincentvdk for the name :) functionality to Ansible, in order to allow having encrypted vars in vars files, playbooks, etc.

These encrypted vars can be decrypted in templates. This is what it looks like in a playbook:

```yaml
---
- hosts: 127.0.0.1
  gather_facts: false
  connection: local
  vars:
    - mypasswd: "AHchx1Va5fPc51B3HrbMTvO/MGfCIK3cT273PgIeoZdEAY6lg+GEmejsl4tGfCNKxMFP7tM7Y7kl"
  tasks:
  - action: template src=vault.in dest=/tmp/vault.out
```

The encrypted and base64-encoded variable can be used with the `vault` filter in a template:

```jinja2
My secret password: {{ mypasswd | vault }}
with explicit key:  {{ mypasswd | vault('ckey') }}
```

To get this output:

```
My secret password: totallysecret
with explicit key:  totallysecret
```

The first example above uses a default keyname (configured in `ansible.cfg`, whereas the
second used a specific key name. (You can have as many keys as you want.)

### Getting started

Ansible vault requires Keyzcar on the management host (`pip install python-keyczar`), which is also used by fireball mode, so you may have this requirement already.


1. Create the keystore directory. This should be *outside* of your playbook repository, obviously, but you can share it with team members who need access to the keys.

	mkdir /etc/ansible/keystore

2. Choose a key name, say, `ckey`, and make its directory

	mkdir /etc/ansible/keystore/ckey

3. Create an initial key set for the `ckey` key name: (`keyczart` is a utility provided by Keyczar)

	keyczart create --location=/etc/ansible/keystore/ckey --purpose=crypt 

4. Generate a symmetric key and store it at that location

	keyczart addkey --location=/etc/ansible/keystore/ckey --size=256

5. Configure Ansible (`ansible.cfg`) to use the keystore and (optionally) the new key as default:
	
```ini
[vault]
keystore = /etc/ansible/keystore
key = ckey
```

### Creating encrypted vars

Now we can use that key to encrypt variables and use them in vars files, playbooks, etc.

Verify that `ansible-vault` will use your keystore and key names. It will print the defaults
it is using when you give it `-h`.

	ansible-vault -h

Create a var, say, `"mypasswd"` which will be encrypted. (Note the use of `-` as filename):

```bash
echo -n totallysecret | ansible-vault -V mypasswd -
mypasswd: "AHchx1Va5fPc51B3HrbMTvO/MGfCIK3cT273PgIeoZdEAY6lg+GEmejsl4tGfCNKxMFP7tM7Y7kl"
```

Copy the line `mypasswd.*$` to your vars and use in a template as shown above.

### Binary data

If the output of `vault` is binary data (eg. you've encrypted an image), this has to be handled in a special way, because Jinja2 doesn't handle non-UTF-8 data in templates.

Invoke the `vault` filter with a parameter specifying the name of an output file on the managing node, and then you can `copy` this file to the managed nodes. For example, in a template:

```jinja2
image >>{{ jjolie  | vault(outfile='/tmp/vault-binary.out') }}<<
```

This would produce an empty string instead of the `{{ ... }}`, and the specified file will contain the decrypted binary data.

The `vault()` filter also supports a `return=` keyword with which I can set what it will "print". This allows me to do something like this

```yaml
- action: copy
            src={{ imgdata | vault(outfile='/tmp/t1.out', return='/tmp/t1.out') }}
            dest=/tmp/jjolie.jpg
```

in which `vault` decrypts into the specified tmp file, returns a "file name" which is then used by `copy`.