Provide secrets to the autograder

[Paul2708]

In some cases, instructors want to call external APIs in the tests to autograde their students' submissions.
This feature demands two requirements:

• The secret should be kept secret from students.
• The secret should live outside the notebook so it can be easily exchanged without releasing new assignments every time the secret changes.

The simplest approach would be to manage the secret completely externally and mount it as an environment variable into the autograding pod. However, a malicious student could easily get all env vars to expose the secret.

Do you have any ideas how to realize this?

[Paul2708]

Furthermore, I want to note that providing any secrets in a "hidden" test is also not secure, depending on your threat model.

Since the tests are inserted into the notebook before it runs, a malicious student could add instructions to read the file contents and send them to any web server in the exercise that will be executed in the hidden tests. Maybe this could also be mentioned in the docs?