feat: make secret version destruction explicit
Rather than have sanctuary default to destroying all older versions of a secret, make the default behaviour to keep old versions.
Instead, add a new command sanctuary destroy-old-versions
which can be
used to destroy older versions of secrets once an application has been
fully updated.
The reasons for this are outlined in more detail in #31 (closed).
Closes #31 (closed)