Secure config vars

We'd like to provide enhanced security for the most sensitive of config vars for Heroku apps. While config vars are masked today unless you click on them to unmask the ability to unmask **at all** can be undesirable for some levels of secrets.

Workarounds exist of limiting access to the production app, but having config vars that are specifically noted as extra sensitive that become write-only, and cannot be extracted via the Heroku dashboard, seems like a way to make this level of security much more approachable.