[WIP] Setting up a base new-relic setup using ansible vault

- Fixes #67 

This change also introduces a new `ansible-vault` secrets file, which has our encrypted `new-relic` key. A side-effect of this now you'll always need the vault key to deploy/setup.

Thoughts?
I'm totally ignorant on Ansible vault, so this might be a silly or naive q: why do you need to specify *both* the encrypted and unencrypted file here? Shouldn't we always be using e.g. the encrypted one, requiring the password for actions?