Research alternative secrets management / HSM integration

[adewes]

Currently we load settings / secrets from the file system. We should research how we can replace this with a better secrets management approach. The new version of the Go helpers already supports Go's io/fs interface, so we could provide settings through a virtual file system that can combine local files (for non-sensitive settings) and other source (for sensitive settings).

This is just a research task for now, please don't implement anything yet.