The tracker config.ini has multiple secret tokens in it:

  etag token
  jwt token

it would be nice to be able to put a placeholder these fields that allows
the contents of an external file to be loaded.

This would allow the config file to be stored in CM safely.

Maybe use a (pseudo) file url?

  file://filename is an invalid URL, interpret it as filename relative to the 
                  tracker home.
  file:///home/roundup/filename valid URL for file at /home/roundup/filename
                                absolute path

in both these cases, file:// should not start a valid token so easy to identify.

This may also be useful for issue2551064 if we need to rotate keys or specify
multiple keys. Each line could be a separate key.