Allow multiple substitutions blocks per secrets block

[jpslav]

And see if we can't find a way to replace deployment-wide secrets_substitutions with something like:

secrets do
  ..
  substitutions(shared_substitutions)
  substitutions do
    ..
  end
  ..
end

shared_substitutions = Proc.new ...

so that we don't have deployment-wide secrets which may not be appropriate in all situations (e.g. where 3 stacks need to share substitutions but a 4th can't)