Add support for storing secrets in meta-data

Build meta-data cannot be seen via the Buildkite UI, but - curiously - can be returned via the API. This gives a false sense of security to those who think using meta-data is a secure way of passing secret data around.

It would be beneficial to be able to call:

`buildkite-agent secret-meta-data set`

or

`buildkite-agent meta-data set --secret`

or similar, and have that metadata stay hidden from the API.

**Use case**

In the example below, pipeline step 1 operates on an agent queue that has access to secrets, and pipeline step 2 does not.

1. Pipeline step 1 retrieves a secret, and adds the secret as meta-data so that it can be used by the next step in the build
2. Pipeline step 2 reads the secret and does xyz with it

**Notes**

There is nothing I can find in the documentation that suggests secrets shouldn't be passed around via meta-data. Is there any guidance on a recommended approach?

https://buildkite.com/docs/agent/v2/cli-meta-data

Start with the agent v2 CLI meta-data documentation and the existing `buildkite-agent meta-data` command. Clarify which command form is supported and whether secret values must remain hidden from the API, then define the expected handoff behavior between pipeline steps. Done means the chosen interface and security behavior are documented and covered by the relevant checks.

Written by the indexing model from the issue text.