Rather than have sanctuary default to destroying all older versions of a
secret, make the default behaviour to *keep* old versions.

Instead, add a new command `sanctuary destroy-old-versions` which can be
used to destroy older versions of secrets once an application has been
fully updated.

The reasons for this are outlined in more detail in #31.

Closes #31