Ansible credentials support

[evangoad]

Inspired by this: https://eengstrom.github.io/musings/ansible-sudo-var

Could use 1password locally by default, and pass in an empty credentials file for tests.