Store dev mode secrets in dev_secrets.yml.

.gitignore the real file and provide an example.
Pull secrets from dev_secrets[.example].yml.
Helpful comments++
Rename secrets.yml to secrets.prod.yml.
Ignore the One True Secrets File.
Let's call the blank config "nodeless".
Now with a correct comment.
Default secrets appropriately.

`vagrant up`, via `dev_web.yml`, defaults to `secrets.nodeless.yml`.
`script/deploy`, via `site.yml`, defaults to `secrets.prod.yml` and needs
the vault password.
Fixes my syntax highlighting.
Only require the vault passwd when necessary.

If you supply your own secrets.yml, it doesn't need to be encrypted because
it's .gitignore'd. Only pass --ask-vault-pass if you're using the default,
encrypted `secrets.prod.yml`.
Boolean logic is hard
Merge pull request #396 from rackerlabs/unbreak-dev

Provide an unobtrustive mechanism for supplying secrets. :+1: