[Feature] Add support for using secrets when launching an agent

Currently, it is only possible to pass env. variables when launching an agent, but there are multiple scenarios where more security is needed. Passing the secrets as env. variables might expose confidential information in the console. It would be great if besides the `env_vars` on the `launch_bedrock_agentcore` functionality we could pass also a `secret_vars`.

Start at the launch_bedrock_agentcore entry point and trace how env_vars are passed and how launch output is produced. Clarify which secret source and masking behavior secret_vars should use; done means secrets can be supplied without confidential values appearing in console output.

Written by the indexing model from the issue text.