Support credentials injected in the buildkit server

We have a use case where we are running a buildkit server in the Cloud shared by several developers. This is giving us great performance and cache behavior.

Some of our based images are in a private docker registry and are only built/pushed on CI, so developers don't usually have access to this registry. Adding credentials for each new developer is a lot of friction for us, and these credentials are hard to rotate.

We would like to add these credentials to the buildkit server. This way, the session will fetch the client credentials and add the server-side credentials too. We wouldn't need accounts in the registry for every developer, and rotating credentials would be easier because we would only need to rotate the buildkit server credentials.

In this something that aligns with the scope of the project? If so, we are more than happy to work on a PR :-)

Start by tracing how the buildkit server handles session credentials and authentication for private Docker registries. The scope and implementation entry points are not specified in the issue; done would require an agreed design for adding server-side credentials while preserving client access and allowing server-side rotation.