Get username/passwords in a way that doesn't end up in a repo

[drewoldag]

Currently we have username and password in the fibad_default_config.toml file. And there's nothing that would prevent a user from adding their real credentials and pushing to their repo.

It would be nice to introduce some low friction approach that allows users to specify their credentials in a file external to the config toml and that is listed in .gitignore.

If we used a credentials.ini file, it could look like the following:

In fibad_default_config.toml we could include key

[download]
credential_file = '.../credentials.ini'

A default credentials.ini looking like:

username=false
password=false

The user would be expected to either update the credentials.ini or provide their own and update their config accordingly.

There would be a little boilerplate code in the downloader to read and use the .ini file contents and allow us a little more protection against accidentally committing creds.