Encrypt sensitive data in environment configs

Currently all data in the config is displayed in plain text or would need to execute a child process in order to decrypt any encrypted data.

Proposal:
In config specify what encryption followed by the encrypted value.  Should look like:

```
Env=["SHA512:password:a7CXd14WsfeEewQsfr"]
```

Grant it, those values are made up, but assume the value is encrypted with sha512.
