A vault secret to read arbitrary variables from and pass to children

[Southclaws]

This can also be used to solve #24

Essentially, any variables prefixed with PICO_ can be reserved for Pico use, such as PICO_GIT_USERNAME to solve #24

Then, any other variables can just be passed to every future task.

The secret can sit at VAULT_CONFIG_PATH which will default to pico. Along with the default base path, this would place the default config path at /secret/pico which seems logical.

[Southclaws]

Currently, all environment variables from the process are passed to children. This is insecure and can leak information about the host machine into children and reduce the boundary between applications.

This should be disabled and only variables that are prefixed should be passed through (with the prefix stripped).

And the same logic applied to secret stores.

[Southclaws]

The PR for #24 landed but with the names GIT_* instead of PICO_ prefixed.