Compose has added a <service>.build.secrets key and ...ssh is on the way

compose-spec/compose-spec#238

It looks to me to be broadly similar to build.x-bake.secrets so hopefully can be supported simply, the only issue might be merging?

I would suggest that if both are present they're merged, de-duplicating by id, but it might be simpler to have a hard error when both are used