feat: allow specifying a path from which secrets are read

[atticus-sullivan]

The incentive behind this is the following: Docker(-compose) supports passing secrets into the container by specifying secrets keys in the docker-compose.yml (https://docs.docker.com/compose/how-tos/use-secrets/). Behind the scenes, this leads to a file being mounted (typically as /run/secrets/<secret_name>) into the container with the secret as content.
Quite a lot of software (like mysql and postgres, see e.g. https://docs.docker.com/compose/how-tos/use-secrets/) nowadays thus supports suffixing configuration options (mostly environment variables) with _FILE for this purpose.

One advantage of this approach is that the secret does not get easily leaked when dumping the environment variables (or inspecting them).

Things to discuss:

• For the most part I did not change what can be configured as environment-variables and what only via the config-file (except SQLALCHEMY_DATABASE_URL which was a must-have for alembic where now the url can also be read from the config-file). Is there a specific reason for not having an env-var option to set secret_session_key or secret_jwt_key_file?
• is the .strip() really right? Are we sure enough people do not use spaces at the beginning/end of their secrets deliberately?
• so far I came up with the precedence CFG_FILE > CFG since from my POV this is the more elegant and secure way while it should not break something accidentally. But of course this could be changed.
• tbh currently this adds some code duplication, probably we should use a helper function at least for reading the file if not for the whole precedence thing (ensuring consistent behavior). A suggestion for the former would be

def read_secret_file(path: str, name: str) -> str:
     try:
         with open(path, "r") as f:
             return f.read().strip()
     except FileNotFoundError:
         raise FileNotFoundError(f"{name} file not found: {path}")
     except PermissionError:
         raise PermissionError(f"Cannot read {name} file: {path}")
     except Exception as e:
         raise RuntimeError(f"Error reading {name} file {path}: {e}")

the big question from my side would be where to place a helper like this? Would the location simply be src/config.py?

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.