Add command-version of `sync.encryption_secret`

[jolars]

Writing the encryption secret into the configuration seems like an anti-pattern to me. It would be nice if taskwarrior allowed a command to be specified instead, perhaps to a new option sync.encryption_secret_cmd?

This would allow users to invoke their password manager and store the secret there instead.