Allow marking environment variables as secrets via import API

The environment variable import endpoint doesn't support marking variables as secrets. All imported variables are created as non-secret, requiring manual marking in the dashboard afterward. This feature would allow specifying which variables should be secrets during import. Also affects the single variable create endpoint (POST /projects/:projectRef/envvars/:slug), not just import.