Allow setting labels on secrets

In uis/devops/user-notify/infrastructure#42 we want to add alerting to check that credential secrets are rotated in a timely manner. In order to do that we want to be able to dynamically query which secrets are credentials which need rotating for use by the monitoring function.

While terraform could create some static configuration document passed to the function, it would be nicer to simply label credentials as such along with their service id.

Add support to this module for setting custom labels.