[WIP] Setting up a base new-relic setup using ansible vault

- Fixes #67 

- [ ] Document `vars.yml` and `secrets.yml` and `secrets.vault.yml`
- [ ] Safeguard branch overrides for production
- [ ] make ansible not crash with log permissions

This change also introduces a new `ansible-vault` secrets file, which has our encrypted `new-relic` key. A side-effect of this now you'll always need the vault key to deploy/setup.

Thoughts?
Well, we'd technically avoid this problem by not allowing deployment to prod from local dev, and we'd be going through some kind of CI/CD pipeline. But maybe that's not worth the effort right now.

Lets just get rid of the un-encrypted `secrets.yml`.