build secrets

[actualben]

• exposing GITHUB_TOKEN as a default build secret
• adding build_secrets input

[actualben]

TODO:

• need to consider the security implications of passing supplemental build secrets as workflow_call inputs
• need to determine if we should accommodate overriding the GITHUB_TOKEN secret
• need to understand what special significance GIT_AUTH_TOKEN has in docker/build-push-action. what does this even mean?:

  Building from the current repository automatically uses the GitHub Token, so it does not need to be passed. If you want to authenticate against another private repository, you have to use a secret named GIT_AUTH_TOKEN to be able to authenticate against it with Buildx

[actualben]

after discussion, we'll keep the ability to add build secrets, but not include the GITHUB_TOKEN by default