Function resolve_secrets_with 

pub async fn resolve_secrets_with(
    cfg: &mut PipelineConfig,
    set: &ResolverSet,
) -> CliResult<()>

Resolve all secret directives using a caller-supplied resolver set (the seam used by tests to inject fakes).