RFC: Bring your own secrets / Environment variables from query string

[maxschmeling]

I had a discussion with @brandonpayton and he suggested I log a ticket for public discussion.

What I'm proposing isn't necessarily just for secrets, but that's the primary use case from which this RFC stems.

I would like to be able to loading a playground using a publicly accessible blueprint, but provide some config (secrets, primarily) through the URL. For my use case, we could provide a blueprint for demoing Remote Data Blocks that includes a full Shopify integration with custom configuration, and all the person loading it would need to do is provide a token in the URL.

e.g. https://playground.wordpress.net/?blueprint-url=https://raw.githubusercontent.com/automattic/remote-data-blocks/trunk/blueprints/latest-shopify/blueprint.json&SHOPIFY_TOKEN=abc123

This could potentially be implemented as a step that has to be added to the blueprint in order for the value to be made available (naming needs some work):

{
  "step": "envVarFromQueryString",
  "queryStringKey": "SHOPIFY_TOKEN",
  "envVarName": "SHOPIFY_TOKEN"
}

[maxschmeling]

@brandonpayton also pointed me to the discussion in #1703 which is very similar. But I wanted to log this still in case the use case or proposed implementation sparks additional discussion.