[Container] Model multi-stage Docker build cache secret persistence

[githubmofo]

Background

Current Dockerfile analysis inspects single-stage directives for root user execution and hardcoded environment variables.

Planned Enhancements (Tracked for v0.7.2)

• Trace secret persistence across multi-stage Docker builds (COPY --from=builder).
• Detect secret leaks in intermediate container cache layers.
• Provide remediation guidance using BuildKit secret mounts (--mount=type=secret).

[githubmofo]

Resolved in v0.9.2: Added rules/supply-chain/TG-SUPPLY-006-container-build-secret-persistence.md modeling multi-stage BuildKit secret mounts (--mount=type=secret) and intermediate cache layer leak prevention.