Support marking variables as secrets via syncEnvVars

The syncEnvVars build extension only syncs plain environment variables, so sensitive values (e.g. database URLs) show up revealable in the dashboard. Add per-variable secret support (e.g. { name, value, secret: true }) so auto-synced vars can be stored as secrets like manually created ones.