Deprecate `HEXPM_USER` and `HEXPM_PASS` in favour of `HEXPM_API_KEY`

[lpil]

To encourage people to use tokens, which are a little safer due to being easier to revoke.

[scristobal]

Hi there! I'd love to contribute to Gleam by working on this ——it seems straightforward enough.

Would you like to simply provide users with a hint/warning, or do you intend to completely discontinue support for HEXPM_USER and HEXPM_PASS, making HEXPM_API_KEY mandatory?

thanks!

[lpil]

It's a deprecation, so we'd print a warning but continue to support it.