Add support for build secrets (#1300)

docker-compatible `--secret id=key,...` arg for `container build`, that
works with Dockerfiles with `RUN --mount=type=secret`

Requires https://github.com/apple/container-builder-shim/pull/69

## Type of Change
- [ ] Bug fix
- [x] New feature  
- [ ] Breaking change
- [ ] Documentation update

## Motivation and Context
Adds support for Dockerfiles that use build secrets (e.g. `RUN
--mount=type=secret ...`)

## Testing
- [x] Tested locally
- [x] Added/updated tests
- [x] Added/updated docs

docs/command-reference.md

@@ -144,6 +144,7 @@ container build [<options>] [<context-dir>]
 *   `--progress <type>`: Progress type (format: auto|plain|tty) (default: auto)
 *   `--pull`: Pull latest image
 *   `-q, --quiet`: Suppress build output
+*   `--secret <id=key,...>`: Set build-time secrets (format: id=<key>[,env=<ENV_VAR>|,src=<local/path>])
 *   `-t, --tag <name>`: Name for the built image (can be specified multiple times)
 *   `--target <stage>`: Set the target build stage
 *   `--vsock-port <port>`: Builder shim vsock port (default: 8088)