Add support for 1Password secret references

[mattt]

This PR adds support for using 1Password secret references (op://vault/item/field) with emcee's authentication flags (--bearer-auth, --basic-auth, --raw-auth). This allows users to securely store and retrieve API credentials from their 1Password vaults at runtime.

{
  "mcpServers": {
    "twitter": {
      "command": "emcee",
      "args": [
        "--bearer-auth=op://shared/x/credential",
        "https://api.twitter.com/2/openapi.json"
      ]
    }
  }
}

It also updates documentation in both the CLI help text and README accordingly.

[mattt]

I originally considered using the official Go SDK, but that felt like overkill for what we're doing here. Shelling out to op read works well and doesn't introduce unnecessary package dependencies.