fix(config): warn to stderr when secrets passed as CLI flags

[margaretjgu]

Closes #514.

[github-actions]

Nothing wrong here. The warning is minimal, placed correctly before the plain-fields loop, emits to stderr rather than stdout, and the two new tests cover both branches cleanly.

[github-actions]

✅MegaLinter analysis: Success

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	0.56s
✅ REPOSITORY	gitleaks	yes		no	no	56.05s
✅ REPOSITORY	git_diff	yes		no	no	0.05s
✅ REPOSITORY	secretlint	yes		no	no	2.1s
✅ REPOSITORY	trivy	yes		no	no	21.12s
✅ TYPESCRIPT	eslint	2		0	0	3.69s

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository