* fix(compose): strip and resolve pre-deploy hook secrets like service env (fixes#422)
normaliseContainerForStore only cleared Config.Env and
ServiceSpec.Container.Env before writing a container record to the
replicated Corrosion store, leaving ServiceSpec.PreDeploy.Env in place.
A secret set via x-pre_deploy.environment therefore replicated to
every machine in the cluster, unlike the same value set via
environment.
ResolveSecrets had the same asymmetry in the other direction: it only
resolved secret://name references in service.Environment, so a
reference placed in the pre-deploy hook's environment passed through
unresolved as a literal string. HasCommandSecretRefs is extended the
same way for consistency.
Add tests pinning both behaviours.
* update docs that secret references are available for pre-deploy hooks
---------
Co-authored-by: Pasha Sviderski <me@psviderski.name>
