Move the PGPASS environment variable to the execute resource

That way it does not appear in the list of running processes while the
command is running

site-cookbooks/kosmos-postgresql/recipes/replica.rb

@@ -48,10 +48,11 @@ unless primary.nil?
       command <<-EOF
 systemctl stop #{postgresql_service}
 mv #{postgresql_data_dir} #{postgresql_data_dir}.old
-PGPASSWORD=#{postgresql_data_bag_item['replication_password']} pg_basebackup -h #{primary[:ipaddress]} -U replication -D #{postgresql_data_dir} -R
+pg_basebackup -h #{primary[:ipaddress]} -U replication -D #{postgresql_data_dir} -R
 chown -R postgres:postgres #{postgresql_data_dir}
 systemctl start #{postgresql_service}
       EOF
+      environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
       sensitive true
       not_if { ::File.exist? "#{postgresql_data_dir}/standby.signal" }
     end