Polish the config/token override stuff

[pvdz]

• Fixes using the SOCKET_SECURITY_API_TOKEN env var. Also supports API_KEY and the prefix SOCKET_CLI for consistency. In a next major we'll probably deprecate the KEY variants.
• Make the CLI emit a proper error message when the config override cannot be parsed, rather than a generic JSON error with stack trace.
• Add some tests around this
• Add notice to config commands when the config is in read-only mode
• Warn when logging in/out while config is in read-only mode