dotenv integration leaks secrets into the nix store

[pkel]

Describe the bug

The .env file may contain secrets. Its contents must remain confidential. source
According to nix philosophy the nix store is not confidential. source
The devenv/dotenv integration copies the contents of the .env file into the nix store.
As a result, the secrets in .env do not remain confidential.

Related:

• Dotenv only evaluates during the build #775

To reproduce

Create .env file with content SECRET=batteryhorsestaples.
Set dotenv.enable in devenv.nix, build the shell.
Search (and find) batteryhorsestaples in /nix.

Version

devenv 1.3.1 (x86_64-linux)