docs(buildpacks): clarify how to use private buildpacks with multi-buildpack

[yanjost]

Why

The current multi-buildpack guide explains .buildpacks syntax and ordering, but it is not explicit about the private buildpack workflow.
This can lead users to try HTTPS private URLs while using ssh-private-key-buildpack, which fails.

What changed

In src/_posts/platform/deployment/buildpacks/2000-01-01-multi.md, this PR adds a minimal section:

• "Can I Use Private Buildpacks?"
• Explicit recommendation to add ssh-private-key-buildpack first
• Concrete .buildpacks example with private git@... URLs and branch syntax
• Note recommending SSH URLs for private repositories when using the SSH key buildpack

Scope

• Docs only
• No product/runtime behavior changes

[benjaminach]

I find the format of this page a bit unusual, but since your addition respects the general format of the page... LGTM.

[Frzk]

praise: thanks, I didn't know it was possible to do this!

comment: same as @benjaminach -- Looks like another page that would benefit from a rewrite 😫

suggestion: maybe it would be nice to also update (or even remove) the paragraph here: https://doc.scalingo.com/platform/deployment/buildpacks/custom#private-buildpack?

[yanjost]

@Frzk what do you suggest we do with the other "Private buildpacks" section ?

[Frzk]

I'm suggesting to remove it:

• it promotes security by obfuscation ;
• it's much more secure to use the ssh-private-key-buildpack in the multi-buildpack to access a custom private buildpack
• I'm not sure it's even working

@benjaminach: WDYT?

[benjaminach]

I will follow your proposal.

Perhaps, we could promote the .buildpacks file as the standard approach for both custom and multi-buildpack configurations?

Custom buildpacks configured through the env var could instead be documented as a quick workaround to override the buildpack, rather than a clean long-term solution, since configuration should ideally live in the application code 🤔