feat: add secrets input for BuildKit --secret mounts

Lets a build fetch a private fritzlab Go module (or any tokened resource)
without leaking the token into image layers/history the way a build-arg
would. Backward-compatible: empty default, no change for existing callers.
First consumer: fritzlab/agenthub (hub/bridge depends on the private
fritzlab/imessage module).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

action.yaml

@@ -19,6 +19,15 @@ inputs:
   build-args:
     description: Multiline KEY=VALUE pairs passed to docker build
     required: false
+  secrets:
+    description: |
+      Multiline `id=VALUE` pairs mounted into the build as BuildKit secrets
+      (--secret). Use for tokens the BUILD itself needs — e.g. a ci-bot token
+      to `go mod download` a PRIVATE fritzlab module — that must NOT leak into
+      image layers or `docker history` the way build-args would. Reference in
+      the Dockerfile with `RUN --mount=type=secret,id=<id> ...`.
+    required: false
+    default: ''
   smoke-test:
     description: |
       Shell command run after build. The image is exposed as $IMAGE
@@ -61,6 +70,7 @@ runs:
         provenance: false
         network: host
         build-args: ${{ inputs.build-args }}
+        secrets: ${{ inputs.secrets }}
         tags: ${{ inputs.image }}:${{ github.run_number }}
 
     - name: Smoke test