Add Secret store

This is a continuation of https://github.com/dotcloud/docker/pull/5836, and the discussions about it we had on last weeks irc meeting. It implements a secret store that you can access via:
* docker secret list
* docker secret add a-name a-file
* docker secret rm a-name

You can then grant access to a specific secret by using `docker run --grant-secret a-name image`.
The granted secrets are stored (by name) in the hostconfig, and will be re-granted on restarting the container (assuming the secret is still in the store). Additionally any files stored in /etc/docker/secrets are considered "host based" secrets and will be granted to all containers on the host.

On container start the secrets are copied into a tmpfs in /run/secrets, so they will not ever be part of any image based on the container.

There are no docs yet, I'll be working on that next.
There seems to be nothing telling the user how and when to use a granted secret. After reading for a while, I find out that a secret is a file, but I have no idea where in the build it turns up.

Is there a way for a Dockerfile to indicate a need for a secret? Can I use it to add a http_proxy setting at build time? What are the limitations? Can I copy the contents of the secret into the resulting image, thus risking exposing the secret to the world, or will it map to a location in the fs that i need it.