Update secrets handling

[sh1mmer]

This PR makes 3 changes. It is considered a breaking change to the library.

• This change moves all secrets files into the config/secrets folder. This encourages the best practice of isolating secrets in a single place that can be easily removed at build time for projects that may still have secrets in source control.
• The loading of secrets.json is restricted to only apply to production environments. Secrets inheritance has been removed to encourage services to keep secrets for different environments fully separate.
• The case of the NODE_ENV environment variable is normalized to ensure that PRODUCTION and production both work as intended.

cc @Raynos @lxe @mlmorg @aegarbutt

[lxe]

The loading of secrets.json is restricted to only apply to production environments. Secrets inheritance has been removed to encourage services to keep secrets for different environments fully separate.

According to the code, zero-config still loads secrets-NODE_ENV files, but now it's out of config/secrets directory?

[sh1mmer]

All the secrets files are now in config/secrets not just the secrets/secrets.json file. It does still load secrets-<NODE_ENV>.json files but only when the NODE_ENV is not production.

[mlmorg]

If they're in config/secrets, why not simply use NODE_ENV.json as the filenames?

[sh1mmer]

@mlmorg standard approach.

[lxe]

Well zero-config already uses config/env.json (not config-env.json) why not just do config/secrets/env.json?

[lxe]

Well ok then. :+1:

[Raynos]

lgtm except minor comment. please bump major when cutting version

[Raynos]

lgtm. #shipit

[Raynos]

I'm going to land this and cut a new version.