Move Build & Packaging Secrets into a key manager

[directionless]

Today, most of the build and packaging secrets come in via either a local file or an environmental variable. Neither of these feels good. Instead, it would be better if we kept them in GCP's secret manager, and then run things with an appropriate service account. (Or as humans, with human credentials)

This would unify secret management for the build/package things.

Probably also help with the general supply chain security. (Cf: SLSA and whatnot)

Doing this requires:

• Terraform to create / setup GCP secret manager
• Manually populating the secrets
• Creating service accounts for GitHub Actions and MacStadium
• Updating kworker to use above
• Updating porter to use above

[RebeccaMahany]

Putting this aside for now -- the only work remaining is to update porter to use Secret Manager, which is discrete from the other tasks worked on for this issue so far.

[directionless]

I think we can close this. While we should update porter that's pretty tied to GHA, and distinct from the packaging. 🎉