Support Secrets in Build

Issue:
Support docker secret, in concourse jobs that build docker images.

Reference:

docker build has a --secret command line argument. It's different than --build-arg
https://docs.docker.com/engine/reference/commandline/build/

Expected result:
A concourse job can pass a map of secrets to the a job. Just like build-args.

Motivation:
Secrets will not show up in docker inspect. build-args will show up in docker inspect. secrets are safe for passwords. build-args are not safe for passwords.

Concourse credential protected values must be valid values for a secret. Then everything is safe.

docker build --secret is supported in: Docker API 1.39+

Example:

build_args:
  DO_THING: true
  HOW_MANY_THINGS: 2
  EMAIL: me@yopmail.com
  CI_BUILD_ID: concourse-$BUILD_ID
secrets:
  PASSWORD: {{secret_password}}

Start by tracing how the resource currently passes build_args from a Concourse job to docker build, then review Docker's --secret support and the Docker API 1.39 requirement. Done means a job can provide a secrets map alongside build_args and those values are passed as build secrets without appearing in docker inspect; verify compatibility with the supported Docker API versions.