hiera: add another source for secrets

This allows to set the passwords in a file eventually out of source
control or generate it from any kind of vault on the install server.

Fixes #24