Pass secrets in Dockerfile

Setting secrets in a Dockerfile using ENV or ARG is insecure.

Build secrets should be used instead.