Add support for filter commands.  This enabled encrypted dotfiles.

Filter commands are a powerful new feature which enable the mangling of
arbitrary files with custom commands.

They can be used to run any command:

    fresh config/secret.enc --filter="openssl aes-256-cbc -d -a -in"

GnuPG (the most common use case) is configured automatically.

    fresh config/secret.gpg --filter=gpg
    fresh config/secret.asc --filter=gpg

A filter is passed the source file as it's first argument.  If a filter only
reads from STDIN, it may be passed via a backpipe:

    fresh config/dotfile --filter="cat <"