Secrets: keep project-local secret files out of the VM

[neurolabs]

Motivation

Files like .env / .envrc in a project directory are currently visible inside the sandbox VM. Project-local secrets should not be exposed to the VM.

Proposed behavior

Create a configurable mechanism (e.g. *.secret patterns) to keep secret files out of the VM while still keeping them in the project directory.

Alternatives considered

n/a

Blocked by

superradcompany/microsandbox#1448