[feature] Ability to annotate values as defaults that should be changed

It's important to give people software that *just* works. However its also important to encourage people to act securely. It would be great to be able to annotate values as "defaults that should be changed". `ytt` should list any of these defaults that aren't changed when I run it, and maybe even give me a "are you sure y/n" prompt.

This would allow me to put in default passwords and self signed certificates that *work* out of the box for dev situations, but can be gated on taking affect in production or other places.