Manage secrets with ESC

[blampe]

CI workflows often consume over a dozen secrets via environment variables -- some of which were set years ago and aren't available in 1pass. This makes it very difficult (and sometimes impossible) to reproduce behavior locally.

Instead we should manage these secrets via ESC so developers can easily unseal the same environment used by CI.

Something like pulumi/esc#92 would be nice but isn't strictly necessary.

This would probably look like:

• And org-wide "pulumi" environment that all providers can share.
• Per-provider "pulumi-xyz" environments with provider-level overrides.

Migration could be gradual, with GitHub secrets moving into the org-wide environment as needed.