concord-cli: support for remote secrets, configurable secrets providers

[ibodrov]

Config example:

# ~/.concord/cli.yaml
contexts:
  default: # those are the defaults, we don't need to put them in the local config file
    secrets:
      vault:
        dir: "${configDir}/vaults"
        id: "default"
      local:
        enabled: true
        writable: true
        dir: "${configDir}/secrets"
      remote:
        enabled: false
        writable: false
        confirmAccess: true
  prod: # alternative "context", activated with "concord-cli run --context prod ..."
    secrets:
      local:
        enabled: false        
      remote:
        enabled: true
        baseUrl: "http://concord.prod.acme.com"
        apiKey: "foobar"

In future, the feature can be extended to support multiple providers of the same type.