ci: Replace docker build args with secret mounts

[konrad-ohms]

While analyzing the docker build process, I noticed a potential risky transfer of secrets in the docker build process.

docker buildx build --no-cache \
  --build-arg DOWNLOAD_KEY="${DOWNLOAD_KEY}" \
  --platform="${TARGETPLATFORM}" \
  --build-arg "TARGETPLATFORM=${TARGETPLATFORM}" \
  -t containers.instana.io/instana/release/agent/static \
  .

The build-args of a docker build are persisted in the docker image history.
As of now, this is not a problem, as the mentioned image is using a multi-staged build and only the last image (parts after the last FROM statement) are persisted. But, if statements in the Dockerfile are rearranged or the DOWNLOAD_KEY variable is used somewhere in the last stage, it could be present in the docker image metadata and everyone could fetch them via checking the docker history output.

This was a common problem in lots of projects, but buildkit implemented a solution for that problem.
Instead of using build-args, buildkit offers dedicated secret mounts which we should incorporate instead.

https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/reference.md#run---mounttypesecret

I propose to switch to the secret mounts to avoid potential risks going forward, it should be implemented in the concourse since v0.10.0 (concourse/oci-build-task#88).

[FelixMarxIBM]

LGTM