build/bake: BuildKit secrets support

[crazy-max]

fixes #40
closes #239

This adds BuildKit secret support to the build and bake reusable workflows through a shared build-secrets workflow secret.

The new build-secrets secret accepts a YAML object that maps BuildKit secret IDs to secret values. The build workflow parses that YAML and forwards each entry to docker/build-push-action through secret-envs. The bake workflow uses the same contract and appends matching *.secrets+=id=...,env=... overrides for docker/bake-action.

A caller can pass a literal multiline secret with YAML block syntax.

secrets:
  build-secrets: |
    npmrc: |
      //registry.npmjs.org/:_authToken=token
      always-auth=true

A caller can also pass GitHub secrets through toJSON(...) so multiline values and YAML-sensitive characters are preserved.

secrets:
  build-secrets: |
    npmrc: ${{ toJSON(secrets.NPMRC) }}
    aws_credentials: ${{ toJSON(secrets.AWS_CREDENTIALS) }}

Reusable workflows cannot accept arbitrary dynamic secret names, so this keeps the public contract stable while still allowing callers to provide any BuildKit secret ID they need. File-based secrets are intentionally not supported because these workflows build from Git context and do not checkout the caller repository, so caller workspace paths are not available in the build job.