Unify the secrets files.

Rather than wrangling `secrets.prod.yml` and `secrets.staging.yml` separately, unify them into a single `secrets.vault.yml` file. I'll still give preference to a git-ignored `secrets.yml` file for local customization.

I need to wrangle a few variables for this to work; we were relying on the correct secrets file to populate a same-named variable for a role in a few places, namely:

* `mailgun_domain`
* `sponsorship_notification_email`
* `sponsorship_container`

Remaining work:

- [x] Update each `vars_files` that loads the old secrets files with the new one.
- [x] Populate vars with either the staging or production versions of the changed keys.
- [x] Bring the `secrets.nodeless.yml` file up to date. Possibly call it `secrets.minimal.yml` instead, "nodeless" kind of bothers me, especially because it still installs node.

Fixes #769.