Ability to generate an image with secret accounts

[mhofman]

Since we're considering using the a3p tooling for generating public testnet images, we need to find a way to generate such images with governance and other privileged accounts as actual secrets.

That means the mnemonic / private key should come from the secrets in the GH action, and never appear in any docker image layer or log output.

One way is possibly to take the secrets from the GH action, and use a secret mount during the docker build step.