Add --legacy-db-key parameter to drush migrate-update

Currently using the --configure-only flag on drush migrate-upgrade will result in the source database's connection information (including password) being included in the resulting configuration entity. That config entity exports to migrate_plus.migration_group.migrate_drupal_7.yml looking something like

shared_configuration:
  source:
    key: drupal_7
  database:
    driver: mysql
    username: pantheon
    password: 123XXXXXXXX
    host: dbserver.dev.123XXXXXXXXXXX.drush.in
    port: '123XXXXX'
    database: pantheon
    prefix: null

My concern is that it is likely that someone using --config-only will then export their config to yml where their source database password will then be committed to version control.

For my own personal project migrating D7 to D8 I have simply deleted the database key from this .yml file before ever committing it. So the shared_configuration key looks like this:

shared_configuration:
  source:
    key: drupal_7

Then in my settings.php file I set up a connection to the key drupal_7 in such a way that the password is not committed to git.

Rather than expecting users to know to update their config file before committing, I think it would be preferable to set up the source database connection in settings.php first, and then run something like

drush migrate-upgrade --configure-only --legacy-db-key=drupal_7

I have working code that adds this flag. I will clean it up and post a patch. I understand if the question of which pieces of drush migrate-upgrade move into Drush itself have to be figured out before this patch could be committed. #2706693: Split out configure-only functionality to separate command?