simplify secrets file format

Each secret file to be deployed is now backed by one local file.
This simplifies 'setup-secrets' and the secret definitions.
Also, with the old format it was not possible to add new secrets
to secrets.nix in a simple way.

Old secrets are automatically converted to the new format when running
nix-shell.

Using the new option 'nix-bitcoin.secrets', secrets are now directly
defined by the services that use them.

modules/lightning-charge.nix

@@ -30,7 +30,7 @@ in {
       requires = [ "clightning.service" ];
       after = [ "clightning.service" ];
       serviceConfig = {
-          EnvironmentFile = "/secrets/lightning-charge-api-token";
+          EnvironmentFile = "/secrets/lightning-charge-env";
           ExecStart = "${pkgs.nix-bitcoin.lightning-charge}/bin/charged -l ${config.services.clightning.dataDir} -d ${config.services.clightning.dataDir}/lightning-charge.db";
           # Unfortunately c-lightning doesn't allow setting the permissions of the rpc socket,
           # so this must run as the clightning user
@@ -42,5 +42,6 @@ in {
         // nix-bitcoin-services.nodejs
         // nix-bitcoin-services.allowTor;
     };
+    nix-bitcoin.secrets.lightning-charge-env.user = "clightning";
   };
 }