New settings option builds.trusted_forks

By default we don't allow access to secure env variables or addons for
pull requests from forks - this is a security concern, anyone can send a
pull request, so an attacker could compromise secure data.

This is less relevant to private repositories, but it still applies,
because people with pull access can open a PR.

This change allows to specify trusted_forks, which will allow to use
secure env vars and addons on PRs from whitelisted repositories.