Store dev mode secrets in dev_secrets.yml.

.gitignore the real file and provide an example.
Pull secrets from dev_secrets[.example].yml.
Helpful comments++
Rename secrets.yml to secrets.prod.yml.
Ignore the One True Secrets File.
Let's call the blank config "nodeless".
Now with a correct comment.
Default secrets appropriately.

`vagrant up`, via `dev_web.yml`, defaults to `secrets.nodeless.yml`.
`script/deploy`, via `site.yml`, defaults to `secrets.prod.yml` and needs
the vault password.
Fixes my syntax highlighting.
Only require the vault passwd when necessary.

If you supply your own secrets.yml, it doesn't need to be encrypted because
it's .gitignore'd. Only pass --ask-vault-pass if you're using the default,
encrypted `secrets.prod.yml`.
Boolean logic is hard
Remove -s option on which, not available on Ubuntu
Suppress all output from which ansible-playbook
Merge pull request #396 from rackerlabs/unbreak-dev

Provide an unobtrustive mechanism for supplying secrets. :+1:
Merge pull request #398 from rackerlabs/whichscript

Remove -s option on `which`, which isn't available on Ubuntu
Update description