feat(compose): use one secret bundle for local services

scripts/test-vector-secret-policy.sh

@@ -14,10 +14,13 @@ printf 'safe-quoted-\047-dollar-$' >"$tmp/valid"
 printf 'docker-secret' >"$tmp/docker"
 printf 'owner-readonly' >"$tmp/readonly"
 printf 'too-open' >"$tmp/open"
+printf '# comment\n\nTHT_VECTOR_READER_PASSWORD=reader\nTHT_VECTOR_WRITER_PASSWORD=writer\n' >"$tmp/bundle"
+printf 'THT_VECTOR_READER_PASSWORD=reader\nTHT_VECTOR_WRITER_PASSWORD=writer\nTHT_DWH_API_KEY=one\nTHT_DWH_API_KEY=two\n' >"$tmp/duplicate-bundle"
 chmod 0600 "$tmp/valid"
 chmod 0444 "$tmp/docker"
 chmod 0400 "$tmp/readonly"
 chmod 0640 "$tmp/open"
+chmod 0600 "$tmp/bundle" "$tmp/duplicate-bundle"
 
 for invalid in empty newline space; do
   if validate_secret_file "$tmp/$invalid" "$invalid" >/dev/null 2>&1; then
@@ -36,5 +39,10 @@ if validate_secret_file "$tmp/open" open >/dev/null 2>&1; then
   exit 1
 fi
 test "$(read_secret_file "$tmp/valid" valid)" = "safe-quoted-'-dollar-$"
+test "$(read_bundle_secret "$tmp/bundle" THT_VECTOR_READER_PASSWORD)" = reader
+if read_bundle_secret "$tmp/duplicate-bundle" THT_VECTOR_READER_PASSWORD >/dev/null 2>&1; then
+  echo "secret policy accepted a duplicate unrelated bundle key" >&2
+  exit 1
+fi
 
 echo "shared vector secret policy contracts passed."