Allow secrets to be provided from a file or environment variable

[sisuresh]

Description

Resolves #1316

Checklist

• Reviewed the contributing document
• Rebased on top of master (no merge commits)
• Ran clang-format v8.0.0 (via make format or the Visual Studio extension)
• Compiles
• Ran all tests
• If change impacts performance, include supporting evidence per the performance document

[Copilot]

Pull request overview

Adds support for resolving sensitive config values (currently NODE_SEED) from external secret sources, primarily via $FILE: references, and documents / tests the behavior.

Changes:

• Introduce util/SecretManager for resolving $FILE:-prefixed config values with permission checks and whitespace trimming.
• Update config parsing to allow NODE_SEED to be read from a $FILE: reference and reject such references on public network config.
• Add unit tests and update the example config documentation for $FILE: usage.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
src/util/SecretManager.h	New API for resolving config secrets (e.g., $FILE:).
src/util/SecretManager.cpp	Implements file-based secret resolution and permission validation.
src/main/Config.cpp	Uses SecretManager when parsing NODE_SEED; rejects external secrets on pubnet.
src/main/test/ConfigTests.cpp	Adds tests for secret resolution and config integration.
docs/stellar-core_example.cfg	Documents $FILE: usage for NODE_SEED.

---

You can also share your feedback on Copilot code review. Take the survey.