Support sops secret encryption

[ZIJ]

Currently supporting sops would require granting the orchestrator backend privileges to decrypt them, because it checks out the repo prior to starting the jobs. This is not ideal from security / compliance standpoint; we'd want to keep the high-privilege operations confined within the CI job whenever possible.

Potential solution: move parsing logic to a warmup job

[ZIJ]

Potential solutions:

• https://github.com/diggerhq/digger/issues/1107