Default to empty hash if a non-hash or nil key is provided
In some cases (like in cookbook-wrapper-gitlab-runner, we have chef_vault defaults set like:
default['cookbook-gitlab-runner']['secrets']['backend'] = 'chef_vault'
default['cookbook-gitlab-runner']['secrets']['path'] = 'gitlab-runner-chatops'
default['cookbook-gitlab-runner']['secrets']['key'] = 'prd'
This means that if we only set the backend/path in a role, the key will remain as prd, which we want to discard, so this MR adds a check so that if a non-hash is provided (or nil) for a key, then just set it to an empty hash.
Related: https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/16308