Access control for Heroku pipeline especially since Heroku pipelines config vars are accessible by all team members

### Required Terms

- [x] I agree to follow this project's [Code of Conduct](https://github.com/heroku/roadmap/blob/main/CODE_OF_CONDUCT.md)
- [x] I have read and accept the [Salesforce Program Agreement](https://www.salesforce.com/company/program-agreement/)

### What service(s) is this request for?

Heroku Pipeline

### Tell us about what you're trying to solve. What challenges are you facing?

Heroku should secure its pipelines since all members and viewers get access to entire pipeline data that includes the CI variables and confiv vars which are sensitive API keys and tokens for third party like DBs or Jenkins etc.