[#130559285] store generated SCS secrets in vault
[#130559285] store generated SCS secrets in vault

The original behavior of the SCS plugin was to generate missing
secrets every time.  The secrets could be READ from vault, but
would never be written to vault.

As a result, it was impossible to deploy overtop an existing SCS
deployment, as the secrets would be regenerated and apps bound
to the service would lose their connection to the broker.

This change adds a new flag --vault-hash-secret which should point
to a new hash dedicated for vault secrets.  If the plugin ends up
generating any secrets, it writes them back to this hash so that
future deployments will use the same secrets.

Implementation note:

  The goal here was to not require a --vault-rotate flag to generate
  secrets for the first time.  The idea is that any secrets that are
  missing will be generated and saved so that they do not need to be
  generated the next time.

  Our current vault client doesn't expose the raw values from vault,
  so we have to manually look at the flags AFTER doing a vault
  unmarshal to determine if they were present in vault.

  This logic will be simplified (and unified across plugins) in the
  near future when we break out a credential provider as a core feature.

enaml-ops/omg-product-bundle,enaml-ops/omg-product-bundle