References to secrets resolved at HostKit control-plane boundaries.
@type source() :: {:env, String.t()} | {:file, String.t()} | {:command, {String.t(), [String.t()]}}
@type t() :: %HostKit.Secret{source: source()}
@spec command(String.t() | [String.t()] | {String.t(), [String.t()]}) :: t()
@spec env(String.t()) :: t()
@spec file(String.t()) :: t()
@spec from_opts!(keyword()) :: t() | :redacted
@spec resolve!(term()) :: term()
@spec secret?(term()) :: boolean()