This can also be used to solve #24

Essentially, any variables prefixed with PICO_ can be reserved for Pico use, such as PICO_GIT_USERNAME to solve #24

Then, any other variables can just be passed to every future task.

The secret can sit at VAULT_CONFIG_PATH which will default to pico. Along with the default base path, this would place the default config path at /secret/pico which seems logical.