Allow secret_commands to specify an unless or override command

[rwstauner]

For secret_commands we could define a command in the config that would allow for disabling the fetching of the secret.

As an example, it could simplify entrypoints if we could tell muss not to set a secret that is already configured in .env*.local instead of getting the secret under a different name and making the entrypoint have to decide whether or not to set it.

vault:
    # unless? override? local override?
    # unless would just not set it... override would set it?
    # maybe both?
   unless: [sh, -c, 'grep -E "^$1=" ${2:-.env*.local}', --]