Allow fetching passwords from environment variables

[zx2c4]

Passing sensitive data through command line args is not generally safe on many *nix systems, because the arguments leak to all users, such as through /proc/PID/cmdline on Linux.

Instead, the usual pattern for passing passwords to programs is via environment variables, which do not leak to all users. Wire up the input getter's logic to handle these.

The existing logic is:

• If the argument is a file that exists or starts with file:, treat it as a file and read its contents.
• Otherwise, treat it as the data itself.

The new logic is:

• If the argument is a file that exists or starts with file:, treat it as a file and read its contents.
• If the argument starts with env: and that environment variable exists, treat it as an environment variable and read its contents.
• Otherwise, treat it as the data itself.

Requiring the environment variable to actually exist -- much like how file's unprefixed by file: have to exist to be considered as files -- will mitigate false positives of, e.g., actual passwords that begin with "env:", so the potential for regression should be exceedingly low.

[zx2c4]

The two failures seem to be issues running something called "ghost tunnel". Is that a CI flake?

[qpernil]

Yes the hardware tests require access to secrets that your branch doesn't have access to. I will test manually.