Use ejson to manage build secrets

.buildkite/hooks/pre-command

@@ -1,4 +1,7 @@
-#!/bin/bash -e
+#!/usr/bin/env bash
+set -e
+
+eval "$(ejson2env .buildkite/env/secrets.ejson)"
 
 # Ensure the pattern "+++ ..." never occurs when |set -x| is set, as buildkite
 # interprets this as the start of a log group.
@@ -24,4 +27,3 @@ export PS4="++"
   set -x
   rsync -a --delete --link-dest="$d" "$d"/target .
 )
-