Support secrets in cli exec (#5374)

pipeline/frontend/yaml/compiler/option.go

@@ -15,6 +15,7 @@
 package compiler
 
 import (
+	"maps"
 	"net/url"
 	"path"
 	"strings"
@@ -74,9 +75,7 @@ func WithMetadata(metadata metadata.Metadata) Option {
 	return func(compiler *Compiler) {
 		compiler.metadata = metadata
 
-		for k, v := range metadata.Environ() {
-			compiler.env[k] = v
-		}
+		maps.Copy(compiler.env, metadata.Environ())
 	}
 }
 
@@ -143,9 +142,7 @@ func WithLocal(local bool) Option {
 // added by default to every container in the pipeline.
 func WithEnviron(env map[string]string) Option {
 	return func(compiler *Compiler) {
-		for k, v := range env {
-			compiler.env[k] = v
-		}
+		maps.Copy(compiler.env, env)
 	}
 }