Created AWS resource for services token, held in secrets manager. Until we have rotation done, the secret password is generated once with Terraform, except local dev where it's hardcoded.

Depends on D9275

Tested on localstack and staging. The secret resource is accessible both through the API (next diffs) and AWS CLI