Add support for Vault

[juicemia]

Pipelines should be able to read from Vault for secrets.

For now it's only necessary to look for secrets at a shared Vault. They can be scoped by pipeline-remote/pipeline-name. So for example, if the user has the following defined in a task:

arguments:
  PASSWORD:
    vault: secret/app-dev:password

the repo was at github.com/project/app, and the pipeline's name is default, runlet would look for the secret at secret/github.com/project/app/default/app-dev:password. runlet would search in its shared Vault. The client can be configured by using VAULT_ADDR and VAULT_TOKEN.