Docker RUN rm Didn't Delete My .env. 3 of 14 Images Still Had It

RUN rm in a Dockerfile hides a file but leaves it in Docker image layers. How I found leaked .env files and how BuildKit secrets fix it.