Support using env vars (including decrypted env vars) in command

We want to only use flags for configuring our executable, e.g. marathon environment configuration:
```
PAL_SECRETS_YAML: |
---
prod:
command: "exec /example-binary -some.flag=$SOME_VAR"
env:
SOME_VAR: pgp:***********
```
However, pal currently does not support this.

Right now, the only workaround would be to create a wrapper script.

e.g. `run.sh` wrapper script:
```
exec /example-binary -some.flag=$SOME_VAR
```
e.g. marathon environment configuration:
```
PAL_SECRETS_YAML: |
---
prod:
command: "run.sh"
env:
SOME_VAR: pgp:***********
```

It would be ideal if we did not require this wrapper script.