allow specification of data bag secret

  - new attribute added: data_bag_secret
  - defaults to /etc/chef/encrypted_data_bag_secret