add --with-env flag to publish command

[glours]

this flag allow publishing env variables in the Compose OCI artifact

What I did
Add --with-env flag to let user explicitly optin the publication of env variables in the OCI artifact

Related issue
https://docker.atlassian.net/browse/COMP-873

(not mandatory) A picture of a cute animal, if possible in relation to what you did

[glours]

@aevesdocker can you check if the new error message is ok for you? 😇 🙏

[glours]

@ndeloof I wonder if we should not just set all env variables to empty strings when publishing? 🤔
This way we'll push the env variables needed to run the application without sending sensitive data and we'll be able to ask consumers to set values when doing an docker compose -f oci://... up, wdyt?

[ndeloof]

service.environment may be set with a fixed value, not relying on any interpolation. Typically:

db:
    image: mysql
    environment:
      MYSQL_DATABASE: avatar
      MYSQL_ROOT_PASSWORD_FILE: /run/secrets/db-password

those should not prevent compose file to be published, right ?

[glours]

In fact yes that should prevent from publishing by default because you can also have MYSQL_ROOT_PASSWORD: mySuperSecretPassword defined the same way

[ndeloof]

I wonder the approach is correct.
IIUC the goal is to detect the compose file doesn't require env var to be set by user / risk user environment to leak. To prevent this, better load the compose model without any variable passed to interpolation, which will fail if some is needed.

[glours]

After internal discussions with @ndeloof , we have decided to maintain the defensive approach for now. If, based on usage and user feedback, we find this behavior too restrictive, we will keep the option of filtering only interpolated environment variables.