Fetch Buildkite agent tokens from Secret Manager (#2772)

...instead of decrypting files from GCS buckets.
This makes it easier to rotate any tokens.

Note: There are still other tokens left (GitHub etc) that use the old
mechanism. We should migrate them, too.