Add ability for apps to fetch secure strings from SSM

[lorenyu]

Without an option to fetch secure strings from SSM, projects tend to environment variables (e.g. via "extra_environment_variables") since that's the easiest way to get things working, but that's not the most secure way to handle app secrets.

This ticket is to add the ability to configure SSM paths that will store secrets and those will get dynamically added to the container as environment variables when the container spins up.

See https://docs.aws.amazon.com/AmazonECS/latest/userguide/secrets-envvar-ssm-paramstore.html

[lorenyu]

WIP branch navapbc/platform-test#85