not all envars must be secrets

[kesor]

Description of changes:

Allow plaintext values for selected environment variables

Update the configLambda() function to support non-secret (plaintext) values for selected environment variables. Previously, variables like GOOGLE_ADMIN, GOOGLE_CREDENTIALS, REGION, and IDENTITY_STORE_ID were always assumed to reference AWS Secrets Manager ARNs.

With this change:

• If the environment variable starts with arn:aws:secretsmanager:, the existing secrets manager lookup is used.

• Otherwise, the value is used as-is, enabling easier local development and simpler deployments that don’t require Secrets Manager.

• Introduced maybeSecret() helper to conditionally unwrap secrets.

• Applied it to GOOGLE_ADMIN, GOOGLE_CREDENTIALS, SCIM_ENDPOINT, REGION, and IDENTITY_STORE_ID.

Previously:

GOOGLE_ADMIN=arn:aws:secretsmanager:...

Now allowed:

GOOGLE_ADMIN=[email protected]

• Existing secret-based behavior is preserved for backward compatibility.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.