Pair secret-flag registration with its env fallback

Fold the empty-default StringVar and addSecretEnvFallback into a single addSecretFlag(cmd, dst, name, env, usage) call. Previously each secret flag needed two coordinated statements; a new secret flag could re-introduce the usage leak by registering an envOr default and forgetting the fallback. Pairing them makes the safe handling the only handling.