Make pipeline secret redaction default behaviour

[DrJosh9000]

Description

It's like #1593, but for v4.

Further to #1589, pipeline secret redaction should become default in Agent v4.

This PR makes it so that default behaviour is to disallow pipeline uploads containing interpolations of potentially secret environment variables. We add flag to buildkite-agent pipeline upload to allow uploading pipelines with these secrets, but note in the CLI help and the log output that this behaviour is insecure.

We won't merge this until we release Agent v4

Context

Closes #1593

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go tool gofumpt -extra -w .)

Disclosures / Credits

@moskyb