`bitops plan` option

When we get lots of inheritance and charts/values/secrets changing at once, it'd be nice to see what's actually going to change before approving the merge/deploy.

Terraform supports this with `terraform plan`. It'd be nice if bitops could support this for all tools, as they all support _some form_ of "dry run" that we could use for this functionality.

We could also hook into GitLab pipelines for manual approval (which would end up giving us functionality like [this bot](https://www.runatlantis.io/)).

- [`helm upgrade`](https://helm.sh/docs/helm/helm_upgrade/) supports `--dry-run` and `--template` (latter dumps the templates, former just catches errors?)
- [ansible](https://docs.ansible.com/ansible/2.3/playbooks_checkmode.html) supports `--check`

Other stuff to think about:
- What _doesn't_ this cover?
- What about secrets? Would we need something like [GitLab's masked variables](https://docs.gitlab.com/ee/ci/variables/#mask-a-cicd-variable) to ensure those don't make it into build logs?
- Do we need hooks? Would they be a way of emulating GitLab's "manual approval" stage?
- Would running BitOps locally against minikube be more useful instead?