Keep secrets off command lines the runtime records (hq issue 282)

mosquitto passed the broker's admin password to mosquitto_ctrl as -P on
every docker exec, and the container runtime keeps every exec's command
line in its event stream, where docker_events returned it. The admin
credentials now reach mosquitto_ctrl as a 0600 options file fed on
stdin, client passwords at its own prompt, and an argv carrying a secret
is refused before it runs. The admin secret says it is taken at start:
the bootstrap re-runs when the mesh replaces it and re-keys the broker
online from the value it last applied, so it can be rotated.

docker_events redacts what an exec's command line carried, and
docker_secrets_in_events names such secrets by name. keycloak's repair
hands kcadm its passwords through KC_CLI_PASSWORD; minio gives mc its
root alias through MC_HOST_mesh.

modules/docker/module.json

@@ -17,6 +17,7 @@
     "docker_inspect",
     "docker_logs",
     "docker_secrets_in_logs",
+    "docker_secrets_in_events",
     "docker_stats",
     "docker_start",
     "docker_stop",