os.#Container: mount secrets with a more consistent API

Signed-off-by: Solomon Hykes <solomon@dagger.io>

stdlib/os/container.cue

@@ -48,14 +48,14 @@ import (
 
 	// Mount contents from other artifacts.
 	// Mount is active when executing `command`, but not `setup`.
-
 	mount: [string]: {
 		from: dagger.#Artifact
 		// FIXME: support source path
-	} | {
-		secret: dagger.#Secret
 	}
 
+	// Safely mount secrets (in cleartext) as non-persistent files
+	secret: [string]: dagger.#Secret
+
 	// Mount persistent cache directories
 	cache: [string]: true
 
@@ -113,6 +113,9 @@ import (
 						"\(dest)": o
 						// FIXME: support source path
 					}
+					for dest, s in secret {
+						"\(dest)": secret: s
+					}
 					for dest, _ in cache {
 						"\(dest)": "cache"
 					}