What’s the correct way to set a custom secrets provider without having to specify it in each stack’s manifest file? For example, the following (abbreviated) code:

opts := []auto.LocalWorkspaceOption{
	...
	auto.SecretsProvider("awskms://..."),
}

stack, err := auto.UpsertStackLocalSource(ctx, "dev", "example", opts...)
if err != nil {
	log.Fatalf("Failed to load dev stack: %s\n", err)
}

_, err = stack.Refresh(ctx, optrefresh.ProgressStreams(os.Stdout))
if err != nil {
	log.Fatalf("Failed to refresh dev stack: %s\n", err)
}

Results in the following error:

[...] passphrase must be set with PULUMI_CONFIG_PASSPHRASE or PULUMI_CONFIG_PASSPHRASE_FILE environment variables [...]