Credential fetching via command exec

[eropple]

• adds the ability to run a command in order to fetch a secret from a store. For example, you can use 1Password or the macOS keychain to store your credentials now, independently from our config.yaml file, to avoid unencrypted secrets at rest.
• Upgrades config file to version 2
• Includes automatic upgrading to version 2
• adds render config upgrade to permanently upgrade a config file to the latest version (saves backup)

[eropple]

(there is a docs TODO here to cookbook ways to store credentials on various platforms)