extend support for variable expansion

Scenario: hiding credentials for internal pypi index server(s)

< v2.4.0

What already works: prior to v2.4.0, additional pypi index servers had to be added into pyproject.toml. It is possible to hide credentials, because pdm supports variable expansion. But the expansion has two limitations:

1. variables has to be shrunk into a one-liner, instead of defining it on separate rows:

[[tool.pdm.source]]
url = "http://${INDEX_USER}:${INDEX_PASSWD}@test.pypi.org/simple"
name = "test"
verify_ssl = false

(First feature request) It would be more readable, if the expansion worked on individual rows like this:

[[tool.pdm.source]]
url = "http://test.pypi.org/simple"
username = "${INDEX_USER}"
password = "${INDEX_PASSWORD}"
name = "test"
verify_ssl = false

1. expansion works only for auth part - the url cannot be substituted. This is a problem, because it exposes potentially sensitive information about private server url.

(Second feature request) Extend the expansion to cover INDEX_URL as well.

>= v2.4.0

In v2.4.0 option to define other indexes in config.toml was introduced. Unfortunately there is no support for variable expansion.

From this discussion it may seem sufficient to define index information in config.toml as a hiding measure. But consider building container images: It is a valid decision to copy (project specific) config.toml into build image. That way, no such information needs to be included in pyproject.toml, which seems as a cleaner way to go. In this case, sensitive credentials are forwarded into the container image, which is adverse.

(Third feature request) Allow variable expansion for config.toml as well.