Support loading secrets from Vault

Currently, the deployment renders the entire configuration through vault-agent. Replace that by adding a vault client for secrets.