agent/config: support secret values from environment variables

The agent configuration includes some secret values (agent tokens, tls certs, gossip encryption key). We require that most of these values be specified in the config file or command line args using `-hcl`. In some cases there are alternative workflows that allow specifying them via API.

Another option would be to support reading these values from environment variables. That would allow someone to keep the same workflow (simply start the agent process) without having to write these secrets to a disk. Environment variables probably work ok for tokens and the encryption key, but they might be too limited for specifying multiple TLS certificates.

Related Issues:
* #10150 - suggested encrypting the secrets in the config.
* #8306 - addresses the same problem, but suggests reading the values from another system instead of env vars.