These were once used to secure interactions with the web api, back when
we allowed anonymous access to git repositories. This feature was
dropped in the migration to Overleaf v2, and we use OAuth on those
interactions anyway, so these settings are not actually used for
anything, and keeping these around is just confusing.
In both local developent, and production. Also, vendor the `envsubst`
binary from https://github.com/a8m/envsubst, as it supports default
values, which the gnu envsubst (from gettext-base) does not.
