Monopacker currently takes secrets via a (decrypted) secrets file specified on the command line. This should change to make it harder to mix up secrets between environments - secrets should be mapped 1:1 to builders, monopacker should to some extent integrate with secrets tooling.

To start, a builder should be able to be configured with its secrets location, i.e. a path on disk relative to a secrets store, and a command to run to decrypt the secrets in that location.