sandboxes: enable more fine-grained environment control over credentials

Sometimes it doesn't work to set an environment on a whole project and just expect all credentials to work, because:

• Sometimes credentials are owned by a third party and the collaborator creating the sandbox cant just go in and add a new environment
• Sometimes the credential for main and staging are the same (I suspect this happens often a lot in oauth)

So we need a bit more control over how environments work.

Options are:

1. Allow a single step to override the project default environment. I don't love this - it sort of breaks the environment model. And anyway if this is a problem with the credential itself, then you have to do it for every step that uses the cred. Tedious.
2. Let a credential be "universal". Maybe we don't need that language. But basically users flag the credential as universal which means it doesn't use environments at all, and any access uses the main credential.

Thinking about it, it strikes me that credentials should be universal by default, until you add an environment for them. That would simplify the credential UI too because the "environment" field you see on a new credential is scary and unclear. It also reduces the overhead of creating the first sandbox - you don't have to go into each credential and change them all.

The downside is that by default, your sandbox will just use production credentials without any warning - and that might be scary.