Moving tests that require secure envvars to their own script

This is so that pull requests can continue to build.  They do so by not
running the tests that require secure envvars, but that's better than
always failing the build for pull requests.