Implement prototype-based var sources

[vito]

Now that reading vars is done in a separate step (#6274) and has its own presence in the UI, we can make read_var run a container to fetch the credentials instead, with the container 'owned' by the step's plan ID, and showing progress/errors/etc. in the step output.

This could maybe be done backwards-compatibly by creating a prototype-based creds.Secrets implementation. (Though looking at it now, it could also be implemented by thiccening (exec.RunState).Get.)