feat: add cmd substitution for config variables

[nikaro]

What does this PR do?

Add an "cmd substitution" that allow to use password manager to pass credentials in configuration.

Fixes #7487

How did you verify your code works?

• Added test case
• Ran bun dev with some {cmd:op read ...} in my configuration file

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential Duplicate Found:

PR #8198: feat: add apiKeyCommand for dynamic API key retrieval
#8198

Why it might be related: Both PRs appear to address the same problem—dynamically retrieving credentials/API keys at runtime rather than storing them statically in configuration. PR #8198 uses apiKeyCommand for dynamic API key retrieval, while PR #8917 uses exec substitution for the same purpose. These are different implementation approaches to solving the same issue (#7487).

[nikaro]

I used this instead of the supposedly more secure Bun.Spawn because it is much simpler as we don't have to parse/split the user command and handle all the quirks (do not split quoted arguments, what to do about pipes and redirections, etc.).

[betaboon]

i have no say in this, but it would be fantastic if this could become {cmd:foo bar} instead, because it aligns well with some other tools that i am using.

[nikaro]

i have no say in this, but it would be fantastic if this could become {cmd:foo bar} instead, because it aligns well with some other tools that i am using.

I don't mind, I actually had some hesitation between exec and cmd. I will change.