Separate credentials from other environment variables

[0x2b3bfa0]

Closes #561 and fixes #581; not tested locally, waiting for continuous integration to complain if I “committed” some mistake.

[dacbd]

tested with:

terraform {
  required_providers { iterative = { source = "github.com/iterative/iterative" } }
}
provider "iterative" {}
resource "iterative_task" "vscode" {
  #spot      = 0
  timeout   = 24*60*60
  disk_size = 10
  machine   = "t3.small"
  image     = "ubuntu"

  # cloud-specific config
  cloud     = "aws"

  storage {
    workdir = ""
    output  = ""
  } 
  script = <<-END
    #!/bin/bash -x
    apt-get update -y && apt-get install -y ansible git
    ansible-pull --url https://github.com/dacbd/tpi-ansible.git playbook.yml
    env
    aws sts get-caller-identity
    echo "READY"
  END
}