Epic: Shared environment variables and secrets for prebuilds and workspaces

[jldec]

Summary
Environment variables for workspaces are currently only configurable on a per-user basis and cannot easily be shared amongst a team of collaborating users.

Environment variables are not currently injectible into prebuilds.

This epic addresses both of these limitations, starting first at the project-level, and then the team level.

NOTE: Since environment variable are also used for secrets, these enhancements introduce new security considerations.

Context
See RFC (internal)

Value
This is a highly requested feature.

• prebuilds and workspaces would benefit from consistent configuration e.g. for installation directories.
• In some scenarios prebuilds require secrets e.g. to read from non-public storage buckets.

Acceptance Criteria

TBD

Measurement

TBD

Tasks

1. Introduce project-level env vars, and expose them in all project workspaces & prebuilds.
2. Add a visibility warning in the variable-setting UI (especially for public repos).

• Introduce project-level environment variables #4456

[jldec]

Closing this epic. See #7881 for followup.