radicle-node: support loading key material from file — heartwood

Add the RAD_PASSPHRASE_FILE environment variable, which radicle-node will use when RAD_PASSPHRASE is unset. The passphrase will be read from this file, allowing secure storage of passphrases when running radicle from a service manager.

     pub const RAD_SOCKET: &str = "RAD_SOCKET";
     /// Passphrase for the encrypted Radicle secret key.
     pub const RAD_PASSPHRASE: &str = "RAD_PASSPHRASE";
     /// Passphrase file for the encrypted Radicle secret key.
     pub const RAD_PASSPHRASE_FILE: &str = "RAD_PASSPHRASE_FILE";
     /// RNG seed. Must be convertible to a `u64`.
     pub const RAD_RNG_SEED: &str = "RAD_RNG_SEED";
     /// Private key seed. Used for generating deterministic keypairs.

     /// Get the Radicle passphrase from the environment.
     pub fn passphrase() -> Option<super::Passphrase> {
         let Ok(passphrase) = var(RAD_PASSPHRASE) else {
             return None;
         let passphrase = match var(RAD_PASSPHRASE) {
             Ok(passphrase) => passphrase,
             Err(_) => {
                 let passfile = var(RAD_PASSPHRASE_FILE).ok()?;
                 match std::fs::read_to_string(&passfile) {
                     Ok(content) => content,
                     Err(e) => {
                         log::info!(target: "radicle", "Unable to open {}: {}",
                             passfile, e);
                         return None;
                     }
                 }
             }
         };
         if passphrase.is_empty() {
             // `ssh-keygen` treats the empty string as no passphrase,

 recent version of *git* (*2.34.0* or later) must be installed. You can check
 your installation by running *git --version*. Second, *ssh-agent* must be
 installed and running. To bypass ssh-agent, it's possible to set the
 *RAD_PASSPHRASE* environment variable. See the _Environment_ section.
 *RAD_PASSPHRASE* or *RAD_PASSPHRASE_FILE* environment variables.
 See the _Environment_ section.
 == Getting started

 If you would like to bypass *ssh-agent*, you can store your passphrase in this
 environment variable. Note that this is not secure and is equivalent to having
 an unencrypted secret key.
 *RAD_PASSPHRASE_FILE*::
 If *RAD_PASSPHRASE* is unset, *radicle-node* will read the passphrase from
 the filepath in this variable. Depending on how this file is stored, it could
 be more secure than the *RAD_PASSPHRASE* option.

 MemoryDenyWriteExecute=true
 # If your Radicle key is passphrase-protected, you will have to set the
 # `RAD_PASSPHRASE` environment variable to the passphrase supplied during
 # `rad auth`.
 #Environment=RAD_PASSPHRASE=snickerdoodle
 # `RAD_PASSPHRASE_FILE` environment variable to a file containing the
 # passphrase supplied during `rad auth`.
 #Environment=RAD_PASSPHRASE_FILE=/path/to/passphrase
 User=seed
 Group=seed