forward: allow reading secret from environment variable to prevent argv exposure

[DanteJSaavedra]

When using gh webhook forward --secret <secret>, the secret is passed via the command line arguments (argv). This makes it visible to process listing tools (such as Task Manager on Windows, or ps on Linux) and exposes it to other processes running under the same user.

It would be safer to allow passing the webhook secret via an environment variable (e.g. GH_WEBHOOK_SECRET) so that it doesn't leak into the process list.