[WIP] Setting up a base new-relic setup using ansible vault

- Fixes #67 

- [ ] Document `vars.yml` and `secrets.yml` and `secrets.vault.yml`
- [ ] Safeguard branch overrides for production
- [ ] make ansible not crash with log permissions

This change also introduces a new `ansible-vault` secrets file, which has our encrypted `new-relic` key. A side-effect of this now you'll always need the vault key to deploy/setup.

Thoughts?
Cool, thanks for explaining.

I was just thinking that using both might create room for mistakes. E.g. someone makes changes to their local unencrypted file, deploys etc., but then forgets to re-encrypt and commit those changes.

If we always used only the encrypted file, we add a bit of inconvenience, but perhaps are more robust?

I don't have experience with these kinds of things though. WDYT?