Use tap trust for eval all

- Make `HOMEBREW_REQUIRE_TAP_TRUST` and
  `HOMEBREW_NO_REQUIRE_TAP_TRUST` enable commands that evaluate all
  formulae and casks.
- Hide `--eval-all` and `HOMEBREW_EVAL_ALL` from generated help,
  completions and configuration unless the env var is set directly.
- Keep legacy `HOMEBREW_EVAL_ALL` working with a deprecation warning
  so callers can move to the trust model.