Docker BuildKit Secrets Don't Leak Into Images

Pass secrets at build time without baking them into layers.