Command help can expose sensitive credentials

If sensitive parameters (e.g. GitHub access token) is passed by environment variable, then the help page includes this information as a "default" value. Sensitive values should not be exposed here, in case a mistake causes the help page to be displayed.

e.g.
```
...
-token string
Github access token (default "01234567890abcdef")
...
2020/05/07 16:29:56 -sha or GITHUB_COMMIT_SHA required
```

Start by locating the command help generation and the environment-backed flag handling, then reproduce the issue with a token supplied through an environment variable. Done means the help output no longer displays sensitive values as defaults while still showing the flag description.

Written by the indexing model from the issue text.