v2_cart_model: guarantee user env vars override

Bug 1088005
https://bugzilla.redhat.com/show_bug.cgi?id=1088005

Cart env vars were overriding identically-named user env vars, which is
counter to the intended (and documented) behavior. This change merges
the user env vars (from `.env/user_vars`) after merging the cart env
vars in order to enforce the correct precedence.

Squashed commit: user env should override OPENSHIFT_SECRET_TOKEN