datasette publish option for setting plugin configuration secrets

[simonw]

Follow-on from #538 - the datasette publish command needs a way of passing secrets which will be made available to plugin configuration but will not be exposed in /-/metadata.json.

[simonw]

Potential design:

$ datasette publish --plugin-secret datasette-auth-github client_id xxx

This would populate the following in metadata.json:

{
    "plugins": {
        "datasette-auth-github": {
            "client_id": {"$env": "DATASETTE_AUTH_GITHUB_CLIENT_ID"}
        }
    }
}

And would ensure that the environment variable DATASETTE_AUTH_GITHUB_CLIENT_ID is set to the correct value.

[simonw]

As soon as I have this working I can use it to ship a live demo of https://github.com/simonw/datasette-auth-github

[simonw]

$ datasette publish now fixtures.db \
    --branch=master \
    --alias datasette-auth-demo \
    --install=datasette-auth-github \
    --plugin-secret datasette-auth-github client_id 86e397f7fd7a54d26a3a \
    --plugin-secret datasette-auth-github client_secret ...

https://datasette-auth-demo.now.sh/