Hide service binding creds based on role

-Only shows for SpaceDeveloper or Admin role
-Add ability for other models to serialize the
same way with :redact key

[finishes #62436754]
CC now adds all env vars to to the diego.desire.app message

* Refactor AppObserver to use DiegoClient for staging rather than
  DiegoStagerTask

Signed-off-by: Ted Young <tyoung@pivotallabs.com>