Support for KMS

## Prerequisites:

* Is the functionality available in the GitHub UI? If so, please provide a link to information about the feature.

* Is the functionality available through the GitHub API? If the functionality is available, please provide links to the
API documentation (https://developer.github.com/v3/) as well as the Octokit documentation (https://octokit.github.io/).

* If the functionality is not yet available in the API, it would be helpful if you
contacted support (https://support.github.com/) or posted in the Community Forum (https://github.community/). Please
include a link to the forum post if you create one or a copy of the response from support.

## New Feature

Please describe the desired new functionality:

As it stands there are only 2 options for GitHub App private key management:
1. `PRIVATE_KEY` - private key is supplied as env variable, least secure
2. `PRIVATE_KEY_PATH` - path to the private key, slightly more secure

Given the nature of Safe Settings the corresponding GitHub App is usually highly privileged and its private key is probably the biggest security concern. If that key is compromised the impact can be severe. Therefore, I'd like to have an option to store the key in a Key Management Service (e.g. AWS KMS) so the key material never leaves KMS and there are no static credentials for the safe-settings app to handle. The app would only send the payload (or payload digest) to KMS ([sign operation](https://docs.aws.amazon.com/kms/latest/APIReference/API_Sign.html)) and get the signature back so it can create a JWT.