add example how to store secrets off main config file

I store the main gitlab.rb config in VCS to be able to track changes, and secrets should not be committed to VCS

ideally it should be handled more general way (there are more values that should be protected)