Improve sops and gitignore handling

This patch adds the new way to handle secrets by using `.yamld` for
decrypted files. This should help to prevent ever commiting secrets
unencrypted.