Separate access to staging and production secrets

[spbnick]

At the moment it's not possible to gain access to the staging and production credentials separately, and so to give access to testing in staging we also have to give access to production, which is not very safe, and so a lot of PRs go only partially tested before we merge them.

Find a way to separate that access.