Use external secrets in CI to prevent every variables from being expose in all jobs

Support for GSM was announced in 16.8! 🎉

See https://docs.gitlab.com/ee/ci/secrets/index.html / https://docs.gitlab.com/ee/ci/secrets/gcp_secret_manager.html.