secret: Resolve secrets in x-pre_deploy too

[miekg]

This adds the secret:// resolving to the Environment in x-pre_deploy too. Further more the Environment is set to nil when commiting the container to the store.

Fixes: #422

[vky5]

Opened #424 before I saw this, same two fixes. This one doesn't cover the gap for container.go though, no test on the storage-side half of the bug. That's the one the issue title is about. I added one for it in 424, plus a test that a secret referenced from both environment and x-pre_deploy.environment only resolves once.

Also pulled the resolve loop into a shared helper instead of duplicating it in ResolveSecrets and HasCommandSecretRefs. Not required, just less to keep in sync next time someone adds a field.

Whichever you want, I'll rebase the tests onto this one, or close 424.