docs: document inline --set override syntax for ssh and composable attributes

[mvanhorn]

Summary

Documents the inline --set override string syntax for the ssh field (and the
other composable list attributes) in the bake reference docs:

• docs/reference/buildx_bake.md: adds an "Inline values for composable
  attributes" subsection under --set, showing --set "*.ssh=default=$HOME/.ssh/id_ed25519",
  the comma-separated multi-path form, and which fields support sub-key selectors.
• docs/bake-reference.md: adds a note in the target.ssh section pointing to
  the inline id=path form used by --set.

Why this matters

Issue #3556 reported that --set "*.ssh.paths=..." silently sets id instead of
paths. As jsternberg noted, the behavior is actually supported via the inline
form --set "*.ssh=default=$HOME/.ssh/id_ed25519" (multiple paths comma-separated),
but that syntax was lost from the docs when the bake reference migrated examples to
the composable-attribute object form. This change restores the documentation for the
command-line inline form. Verified locally with bake --print: the override resolves
to the expected { id: "default", paths: [...] } agent config.

Fixes #3556

AI was used for assistance.