Add a control for secrets management

[funnelfiasco]

In discussing #302 today,

• Need a “don’t have secrets in your repo”
• “Don’t put secrets in a Google Doc”
• Decision: Need some guidance around using appropriate secrets storage solution
• Sample wording from Eddie: “When a development tool uses secrets for authentication … uses a secure “

[trumant]

I'm willing to pick this one up unless you have plans to pursue in the next couple of weeks @funnelfiasco