hcvault: SOPS_VAULT_TOKEN_FILE environment variable

[Dexmachi]

closes #2168

Implements the SOPS_VAULT_TOKEN_FILE environment variable to decide which path to read the vault token from.

Details

• If the env variable is set, SOPS will attempt to read only from the provided path, no fallbacks.

• If the env variable is set and SOPS fails to read it, it returns an explicit error.

• If the env variable is not set, it uses the current bahaviour, falling back to ~/.vault-token and returns no error if there is an error reading it.

• Supports ephemerally bound files (e.g., FDs)

• All automated tests passing

[felixfontein]

This PR has the same problem that #2163 fixes for age: the file is read more than once, and thus it won't work with fifos etc.

[Dexmachi]

This PR has the same problem that #2163 fixes for age: the file is read more than once, and thus it won't work with fifos etc.

To solve this issue without bringing changes from #2163, I had to essentially replicate the fix I made over there

I'd say against merging this PR until we decide how to go through with that PR in order to avoid duplicate logic. As such, I'll make this into a draft.