Lint Rule for catching common secret related env/arg keys

[daghack]

Adds a SecretsUsedInArgOrEnv lint rule check that checks for common secret-related prefixes or affixes in ENV and ARG keys.

Example Dockerfile

FROM alpine
ENV passwd=banana secret=passwd

Produces the following lint warnings.

WARNING: SecretsUsedInArgOrEnv
Secrets should not be used in the ARG or ENV commands (key named "passwd")
Dockerfile:2
--------------------
   1 |     FROM alpine
   2 | >>> ENV passwd=banana secret=passwd
   3 |
--------------------

WARNING: SecretsUsedInArgOrEnv
Secrets should not be used in the ARG or ENV commands (key named "secret")
Dockerfile:2
--------------------
   1 |     FROM alpine
   2 | >>> ENV passwd=banana secret=passwd
   3 |
-------------------

[thompson-shaun]

/cc @dvdksn for some docs support 😄

[tonistiigi]

This should explain that build secrets or SSH forwarding should be used instead to configure build with sensitive credentials in a secure way. Example can show build secret in action. We can link to https://docs.docker.com/build/building/secrets/ for extra reading.

cc @dvdksn