APPS_JSON_BASE64 is stored in image layer metadata, permanently exposing
private repo tokens (GitHub PATs) to anyone with image pull access.
Replace --build-arg with --mount=type=secret so that apps.json is only
available during the RUN step and never committed to any layer.
Refs: https://docs.docker.com/reference/build-checks/secrets-used-in-arg-or-env/