proxy: allow forwarding vault secrets to the management DispVM

[Guiiix]

Summary

When using vaults in inventory vars, dom0's Ansible decrypts vault content and
values are threated like any other inventory variable: the host's associated values are copied to the disposable VM in clear text inside the merged
host_vars/<host>.yaml file. This is fine when using inventory variables and when dom0 may see the decrypted values, but
it does not allow keeping content encrypted until it reaches the target or working with vaults in roles.

This PR adds an opt-in way to forward vault passwords to the management DispVM so
that decryption happens inside the disposable VM instead of in dom0 /
ManagementVM.

What's new

• New play variable qubes_proxy_pass_vault_secret: a list of vault ids whose
  passwords should be forwarded to the disposable VM. Only the listed ids are sent.

  - hosts: work
    connection: qubes
    strategy: qubes_proxy
    vars:
      qubes_proxy_pass_vault_secret:
        - default
        - my_role_vault
  

The matching secrets are written into the archive sent to the DispVM, and the executor adds the corresponding arguments to the in-VM ansible-playbook call: --vault-password-file for the default id, --vault-id <id>@<file> for any other id.
qubes.AnsibleVM now cds into the extracted directory so vault files are resolved by relative path.

Fixes QubesOS/qubes-issues#10307

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.72%. Comparing base (fb71697) to head (6a1eb39).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #51   +/-   ##
=======================================
  Coverage   83.72%   83.72%           
=======================================
  Files           1        1           
  Lines         215      215           
=======================================
  Hits          180      180           
  Misses         35       35           

Flag	Coverage Δ
unittests	83.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.