feat: add Infisical secret provider - #15060

Add infisical:// support for secrets. Requires the Infisical CLI. Uses its existing login or token.

Read API_KEY from the dev environment:

dagger api call deploy --token=infisical://PROJECT_ID/dev/API_KEY

Read the same secret from the /backend folder:

dagger api call deploy --token=infisical://PROJECT_ID/dev/backend/API_KEY

Replace PROJECT_ID with your Infisical project ID. These examples assume a deploy function with a token secret argument.

For an installed myapp module with a credentials secret setting, checks, and a container shell:

dagger settings myapp credentials infisical://PROJECT_ID/dev/backend/API_KEY

This stores the reference in dagger.toml:

[modules.myapp.settings]
credentials = "infisical://PROJECT_ID/dev/backend/API_KEY"

Run the module's checks or open its container shell with the same setting:

dagger check --module myapp
dagger shell --module myapp

myapp is hypothetical. Its checks and shell container use the credentials setting.

Preserves whitespace. Returns an error if the secret is missing. No new dependencies.

Validation: package tests passed. A temporary CLI stub checked empty, missing, and multiline secrets. No live account test.