bake doesn't handle tilde expansion

Contributing guidelines

• I've read the contributing guidelines and wholeheartedly agree

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

Maybe intentional, but Bake is not able to resolve tilde expansion to mean the user's home directory when used in a bake attribute value.

For example:

$ stat -F ~/token
-rw-r--r-- 1 david david 5 Apr 15 21:51:35 2023 /Users/david/token
$ docker buildx bake
[+] Building 0.0s (0/0)                                                                                                                                                                                
ERROR: failed to stat ~/token: stat ~/token: no such file or directory

Expected behaviour

I expected tilde expansion to resolve to the home directory

Actual behaviour

Tilde is not expanded

Buildx version

github.com/docker/buildx v0.10.4 c513d34049e499c53468deac6c4267ee72948f02

Docker info

No response

Builders list

NAME/NODE       DRIVER/ENDPOINT STATUS  BUILDKIT                         PLATFORMS
default *       docker                                                   
  default       default         running 22.06.0-beta.0-926-g914b02ebaf.m linux/arm64, linux/amd64, linux/amd64/v2, linux/riscv64, linux/ppc64le, linux/s390x, linux/mips64le, linux/mips64
desktop-linux   docker                                                   
  desktop-linux desktop-linux   running 22.06.0-beta.0-926-g914b02ebaf.m linux/arm64, linux/amd64, linux/amd64/v2, linux/riscv64, linux/ppc64le, linux/s390x, linux/mips64le, linux/mips64

Configuration

target "default" {
  secret = [
    "type=file,id=token,src=~/token"
  ]
}

FROM alpine
RUN --mount=type=secret,id=token \
    cat /run/secrets/token > /token

Build logs

No response

Additional info

No response

Start by reproducing the issue with the provided Bake HCL configuration and Dockerfile, focusing on the secret source value using ~/token. Trace the Bake input handling and run the relevant existing tests or a minimal docker buildx bake reproduction. Done means a home-directory tilde path resolves correctly while ordinary paths continue to work.