jenkins: let JENKINS_ADMIN_PASSWORD actually be overridden

docker-compose.yml hardcoded `JENKINS_ADMIN_PASSWORD: admin`, which
silently defeated overrides even though jenkins/casc/jenkins.yaml is
already wired up to read ${JENKINS_ADMIN_PASSWORD:-admin} and the
top-level README documents that users can override the admin password
via this var.

Switch the compose value to `${JENKINS_ADMIN_PASSWORD:-admin}` so it
interpolates from the host shell at compose-time. Default stays
`admin`, matching the README and JCasC behavior; setting the var in
the host env now actually takes effect.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ericsmalling

jenkins/docker-compose.yml

@@ -39,7 +39,7 @@ services:
       COSIGN_PASSWORD: ${COSIGN_PASSWORD:-}
       JENKINS_HOME: /tmp/cgjenkins-home
       CASC_JENKINS_CONFIG: /tmp/cgjenkins-home/casc
-      JENKINS_ADMIN_PASSWORD: admin
+      JENKINS_ADMIN_PASSWORD: ${JENKINS_ADMIN_PASSWORD:-admin}
       # The docker CLI's config dir. Each pipeline's Auth stage runs
       # `chainctl auth configure-docker` which writes a fresh, short-lived
       # token here; subsequent agent docker steps reuse it.