The tracker config.ini has multiple secret tokens in it:

  etag token
  jwt token

it would be nice to be able to put a placeholder these fields that allows
the contents of an external file to be loaded.

This would allow the config file to be stored in CM safely.

Maybe use a (pseudo) file url?

  file://filename is an invalid URL, interpret it as filename relative to the 
                  tracker home.
  file:///home/roundup/filename valid URL for file at /home/roundup/filename
                                absolute path

in both these cases, file:// should not start a valid token so easy to identify.

This may also be useful for issue2551064 if we need to rotate keys or specify
multiple keys. Each line could be a separate key.

Also consider checking to see if the file is executable. If so execute it and
store the first line as the value.

This is to permit use of a secrets management vault for a value.

This could be useful for extensions or detectors config.ini
files for configuring an LDAP access password for handling non-anonymous auth.

Done in changeset:   6578:b1f1539c6a31

Also included [mail] password and [rdbms] password

It does not check for executability.

Note the files are loaded when the secrets are used. So for some like the jwt
or mail password may not load till well after the server is started.