Added config generate-csrf-key, to store a CSRF key that survives restarts and works across instances

Without server.csrf.tokens.key, each server process signs CSRF tokens with
a random key of its own, so tokens are lost on a restart and rejected by
other instances. "job-search config generate-csrf-key" stores a new random
32-byte hex key in the configuration file, without printing it. --print
only prints a key, for JOBSEARCH_SERVER_CSRF_TOKENS_KEY or another
instance. An existing key is only replaced with --force, as that
invalidates every issued token, and no key is stored while
JOBSEARCH_SERVER_CSRF_TOKENS_KEY is set, as it would override the file.

README.md

@@ -62,6 +62,7 @@ Global flags: `--config`/`-c` (config file), `--debug`/`-d` and
 | `job-search config get <key>` | Print one value, e.g. `logging.level` |
 | `job-search config set <key> <value>` | Validate and write one value to the config file |
 | `job-search config set --unset <key>` | Remove a value from the config file |
+| `job-search config generate-csrf-key` | Store a new random `server.csrf.tokens.key` in the config file, so CSRF tokens survive restarts and work across instances (`--print` only prints one; `--force` replaces an existing key) |
 | `job-search migrate` | Apply every pending database migration (same as `migrate up`) |
 | `job-search migrate up` | Apply pending migrations (`--steps N` for only N; `--create` to create a missing database file without asking) |
 | `job-search migrate down --steps N` | Roll back the last N migrations (`--steps 0` rolls back all of them, deleting all data, and needs `--yes`) |