Secret-passing mechanism

Workflows sometimes need to have access to some informations that are too sensitive to be written down in the custom `$ont.Makefile` (or any other file committed to the repository). For example, a GitHub token (to make a GitHub release and push release artefacts), an OpenAI token (for workflows that use OpenAI services, like the new I18N stuff), etc.

For now, whenever the need to pass a sensitive information arises, we devise custom solutions. For example, the need to pass a GitHub token is handled by specific code inside the `run.sh` launcher script.

It would be useful to have a generic mechanism to pass sensitive information from the user’s machine to the ODK container – a mechanism that could be implemented once and for all and would not need to be modified explicitly every time we have a new sensitive piece of information to pass.