Provide a predictable container path for secrets

[danfairs]

Currently, file-based secrets are mounted in under $BENTOML_HOME. This makes it difficult to refer to secrets from environment variables.

My use case is that I would like to set GOOGLE_APPLICATION_CREDENTIALS, so that my service can integrate with Google Cloud. I have the JSON key file mounted as a file secret, but I can't set the path for that variable as I don't know BENTOML_HOME in advance.

Instead, I have to load the credentials dynamically in my service code. It would be great to be able to do this sort of thing without requiring custom code in the service.

[frostming]

@xianml any suggestions for this?