Best practices to keep secrets out of GitLab repositories