envsubst won't substitute secrets

## Affected builder image

`gcr.io/cloud-builders-community/envsubst`

## Expected Behavior
```
APP_KEY=1234
TEST_APP_KEY=hello-world
```

## Actual Behavior
```
APP_KEY=$APP_KEY
TEST_APP_KEY=hello-world
```

## Steps to Reproduce the Problem

`app.yaml` file:
```
...
env_variables:
APP_KEY: ${SECRET_APP_KEY}
TEST_APP_KEY: ${TEST_APP_KEY}
```

`cloudbuild.yaml`:
```
steps:
- id: Config
name: 'gcr.io/${PROJECT_ID}/envsubst'
args: ['app.yaml']
env: ['SECRET_APP_KEY=$$APP_KEY', 'TEST_APP_KEY=hello-world']
secretEnv: ['APP_KEY']

availableSecrets:
secretManager:
- versionName: projects/$PROJECT_ID/secrets/APP_KEY/versions/latest
env: 'APP_KEY'
```

## Additional Info

I can't get the secret value substituted. What am I missing?