supports map of secrets; errors redact plaintext

Signed-off-by: Richard Jones <richard@dagger.io>

tests/tasks/build/build_auth.cue

@@ -19,7 +19,7 @@ engine.#Plan & {
 			input: inputs.secrets.sops.contents
 			#function: {
 				input:  _
-				output: yaml.Unmarshal(input).DOCKERHUB_TOKEN
+				output: yaml.Unmarshal(input)
 			}
 		}
 
@@ -29,7 +29,7 @@ engine.#Plan & {
 				target:   "daggerio/ci-test:private-pull"
 				username: "daggertest"
 
-				secret: dockerHubToken.output
+				secret: dockerHubToken.output.DOCKERHUB_TOKEN.contents
 			}]
 			dockerfile: contents: """
 				FROM daggerio/ci-test:private-pull@sha256:c74f1b1166784193ea6c8f9440263b9be6cae07dfe35e32a5df7a31358ac2060

tests/tasks/gitpull/private_repo.cue

@@ -21,7 +21,7 @@ engine.#Plan & {
 			input: inputs.secrets.sops.contents
 			#function: {
 				input:  _
-				output: yaml.Unmarshal(input).TestPAT
+				output: yaml.Unmarshal(input)
 			}
 		}
 
@@ -30,7 +30,7 @@ engine.#Plan & {
 			ref:    "main"
 			auth: {
 				username: "dagger-test"
-				password: repoPassword.output
+				password: repoPassword.output.TestPAT.contents
 			}
 		}