Add command-version of `sync.encryption_secret`

Writing the encryption secret into the configuration seems like an anti-pattern to me. It would be nice if taskwarrior allowed a command to be specified instead, perhaps to a new option `sync.encryption_secret_cmd`?

This would allow users to invoke their password manager and store the secret there instead.