(aws-ecs): pass a secret to ContainerImage's buildArgs

Currently it is possible to pass only strings to ContainerImage's buildArgs.
Feature request: Add an option to pass a secret to `ContainerImage`. This parameter can be called `buildArgsSecrets` or `secrets` as for `QueueProcessingFargateService`.

### Use Case

I need to create a .ssh key on the machine at build time.

### Proposed Solution

```
const image = ContainerImage.fromAsset('../project-processor', {
buildArgsSecrets: {
GIT_SSH_KEY: EcsSecret.fromSecretsManager(secret, 'gitSshKey'),
}
});

const service = new QueueProcessingFargateService(this, 'QueueProcessingFargateService', {
cluster,
queue,
image,
secrets: {
BOT_TOKEN: EcsSecret.fromSecretsManager(secret, 'botToken'),
}
});
```

Dockerfile:
```
ARG GIT_SSH_KEY
RUN echo "${GIT_SSH_KEY}" > /root/.ssh/git_user_key
```

---

This is a :rocket: Feature Request

The issue names ContainerImage.fromAsset and buildArgs, with QueueProcessingFargateService.secrets as a comparison point. Start by tracing existing buildArgs handling and the ECS secret integration; done means ContainerImage accepts the proposed secret mapping and the Dockerfile example can consume it without exposing the secret.

Written by the indexing model from the issue text.