feat: pass build secrets to buildkit as secrets, not only build args

[liveFreeOrCode]

Description

Native builds pass {{aws:...}} secrets to BuildKit only as build args (--opt build-arg). If a Dockerfile declares that ARG and uses it in a RUN, the value ends up in the image history.

This change also passes each secret as a BuildKit secret:

• Adds --secret id=<KEY>,env=<KEY> next to the existing --opt build-arg:<KEY>=....
• Dockerfiles can read it with RUN --mount=type=secret,id=<KEY>, and it never reaches the image.
• Existing ARG-based Dockerfiles keep working unchanged.
• No schema or config change. Kaniko is untouched.

Motivating case: an image that installs from a private package index, with a Dockerfile that already reads those credentials as BuildKit secrets.

How to test

Unit tests:

cp .env.ci .env   # or export its DATABASE_URL / APP_DB_* values
NODE_ENV=test npx jest src/server/lib/nativeBuild

End to end on a service with a secret env var, e.g. NPM_TOKEN: '{{aws:repo/<repo>/<svc>:NPM_TOKEN}}':

1. Read it in the Dockerfile with RUN --mount=type=secret,id=NPM_TOKEN cat /run/secrets/NPM_TOKEN | wc -c.
2. Build in a PR environment. The step should print a non-zero length.
3. Run docker history --no-trunc <image> and check that the value doesn't appear.

Verifying Changes

• jest for native builds: 86 tests pass, including a new case for the secret flag.
• eslint and prettier pass. tsc reports no new errors versus main (587 before and after).
• Ran the generated script against moby/buildkit:v0.29.0, the image native builds use:
  • A RUN --mount=type=secret step received the value.
  • The value appears nowhere in the image config, history or layers.

Notes

• Build args are still passed alongside the secret. A build arg the Dockerfile never declares isn't recorded in history, so this adds no exposure.
• Dropping the build-arg path later would be a breaking change for ARG-based Dockerfiles, so it isn't done here.