Fetch BuildkiteClient tokens from Secret Manager. (#2649)

This change does not improve security directly. However, it makes it
easier to rotate tokens.

We should also migrate the analytics tokens and get rid of all encrypted
files in GCS buckets.