Remove credentials from hardware.csv

In bare metal provider, the hardware.csv file contains the plain bmc username and password columns. Though being a temporary file to provision a cluster, this still raises security concern as the credential is in disk.

We need to find a way to handle the credential information in different way: either as env vars similar to vsphere providers, or a secret file (similar to snow credentials) which can be stored in another location than the hardware spec.

Start by locating how the bare metal provider reads hardware.csv and handles its BMC username and password. Compare the existing vsphere environment-variable approach and snow secret-file approach mentioned in the issue. Done means credentials are no longer stored in hardware.csv and cluster provisioning still receives them through a secure alternative.

Written by the indexing model from the issue text.