Support for Compose secrets

[aksiksi]

We would need to use docker cp to copy applicable secrets into the container.

The reason is that that this is a runtime feature and therefore requires running commands after the container service comes up. We could either inject a script as ExecStartPost via postStart in Nix in the existing service, or add a new service that handles this (former is preferred).

References

• https://docs.docker.com/compose/compose-file/05-services/#secrets
• https://docs.docker.com/compose/use-secrets/

Compose implementation: https://github.com/docker/compose/blob/4efb89709ccb9f11ce0b6571a1c4674be37a42b7/pkg/compose/secrets.go