Documentation for docker services

This is WIP I figured I would start it while the feature is in review...
The service can in this case provide some validation or sanity checks, before using the credentials. We're thinking of sscache here I assume (or things like it).
Either way, temporary credentials (AWS STS) and encrypted environment variables should also be considered as options here.

**other consideration**, totally unrelated... Do we even need a `task.payload.command` and `task.payload.image`. Can't the primary one just be another entry in `task.services`. None of this fully thought through :)