ansible: Define "image-download" job secret

Tests will need that to download private (RHEL) images from the stores.

For now this is the same directory as the upload secret, but at some
point we should split them.

ansible/roles/tasks-systemd/tasks/main.yml

@@ -79,10 +79,15 @@
 
       [container.secrets]
       # these are *host* paths, this is podman-remote
+      # FIXME: Split the upload/download secrets
       image-upload=[
           '--volume=/var/lib/cockpit-secrets/tasks/s3-keys/:/run/secrets/s3-keys:ro',
           '--env=COCKPIT_S3_KEY_DIR=/run/secrets/s3-keys',
       ]
+      image-download=[
+          '--volume=/var/lib/cockpit-secrets/tasks/s3-keys/:/run/secrets/s3-keys:ro',
+          '--env=COCKPIT_S3_KEY_DIR=/run/secrets/s3-keys',
+      ]
       github-token=[
           '--volume=/var/lib/cockpit-secrets/webhook/.config--github-token:/run/secrets/github-token:ro',
           '--env=COCKPIT_GITHUB_TOKEN_FILE=/run/secrets/github-token',