CI: Enable services on Flatpak builds

The flatpak-builder tool now supports passing secrets options to the
build system. These options are not printed during the build, nor
added to the resolved manifest after build, so they don't leak env
vars from CI.

Make secret variables part of the Flatpak workflow environment, like
the main workflow. Pass the various services hashes and clientids to
the build system using the new "secret-opts" key.

.github/workflows/flatpak.yml

@@ -8,6 +8,16 @@ on:
     paths-ignore: ['**.md']
     branches: [master]
 
+env:
+  TWITCH_CLIENTID: ${{ secrets.TWITCH_CLIENT_ID }}
+  TWITCH_HASH: ${{ secrets.TWITCH_HASH }}
+  RESTREAM_CLIENTID: ${{ secrets.RESTREAM_CLIENTID }}
+  RESTREAM_HASH: ${{ secrets.RESTREAM_HASH }}
+  YOUTUBE_CLIENTID: ${{ secrets.YOUTUBE_CLIENTID }}
+  YOUTUBE_CLIENTID_HASH: ${{ secrets.YOUTUBE_CLIENTID_HASH }}
+  YOUTUBE_SECRET: ${{ secrets.YOUTUBE_SECRET }}
+  YOUTUBE_SECRET_HASH: ${{ secrets.YOUTUBE_SECRET_HASH }}
+
 jobs:
   flatpak_builder:
     name: Bundle

CI/flatpak/com.obsproject.Studio.json

@@ -259,6 +259,16 @@
         "-DENABLE_PULSEAUDIO=ON",
         "-DWITH_RTMPS=ON"
       ],
+      "secret-opts": [
+        "-DRESTREAM_CLIENTID=$RESTREAM_CLIENTID",
+        "-DRESTREAM_HASH=$RESTREAM_HASH",
+        "-DTWITCH_CLIENTID=$TWITCH_CLIENTID",
+        "-DTWITCH_HASH=$TWITCH_HASH",
+        "-DYOUTUBE_CLIENTID=$YOUTUBE_CLIENTID",
+        "-DYOUTUBE_CLIENTID_HASH=$YOUTUBE_CLIENTID_HASH",
+        "-DYOUTUBE_SECRET=$YOUTUBE_SECRET",
+        "-DYOUTUBE_SECRET_HASH=$YOUTUBE_SECRET_HASH"
+      ],
       "sources": [
         {
           "type": "dir",