Separate staging and production secrets.

Fixes #401.

- [x] Create the vaulted staging file -- same password.
- [x] Use it from `staging_web.yml`.
- [x] Template the destination container used for sponsorship submissions. Make sure that it's in both production and staging secrets files.
What, you can't sight-decrypt AES256? :tongue: