Create feature flag for ext-workloads

We load this unconditionally, which requires the use of a Cloudflare tunnel. We can make the entire installation of cloudflared for workloads optional, which removes the need to share secrets in the global configuration.

These should be optional and configured per-provider.