fix(secrets): Add custom decoder with default values for XAppleSecretsConfig

- Add init(from decoder:) with proper default value handling
- Required fields (mount) throw on missing
- Optional fields use defaults: readOnly=true, noexec=true, nosuid=true, cleanup=.immediate
- Fixes XAppleSecretsParserTests and HonchoStackSecretsE2ETests

Author: amazon1148

Sources/Container-Compose/Codable Structs/XAppleSecretsConfig.swift

@@ -52,6 +52,16 @@ public struct XAppleSecretsConfig: Codable, Hashable, Sendable {
     case cleanup
   }
 
+  public init(from decoder: Decoder) throws {
+    let container = try decoder.container(keyedBy: CodingKeys.self)
+    self.mount = try container.decode(String.self, forKey: .mount)
+    self.filter = try container.decodeIfPresent([String].self, forKey: .filter)
+    self.readOnly = try container.decodeIfPresent(Bool.self, forKey: .readOnly) ?? true
+    self.noexec = try container.decodeIfPresent(Bool.self, forKey: .noexec) ?? true
+    self.nosuid = try container.decodeIfPresent(Bool.self, forKey: .nosuid) ?? true
+    self.cleanup = try container.decodeIfPresent(CleanupPolicy.self, forKey: .cleanup) ?? .immediate
+  }
+
   public init(
     mount: String = "/run/secrets",
     filter: [String]? = nil,