Added config generate-csrf-key, to store a CSRF key that survives restarts and works across instances

Without server.csrf.tokens.key, each server process signs CSRF tokens with
a random key of its own, so tokens are lost on a restart and rejected by
other instances. "job-search config generate-csrf-key" stores a new random
32-byte hex key in the configuration file, without printing it. --print
only prints a key, for JOBSEARCH_SERVER_CSRF_TOKENS_KEY or another
instance. An existing key is only replaced with --force, as that
invalidates every issued token, and no key is stored while
JOBSEARCH_SERVER_CSRF_TOKENS_KEY is set, as it would override the file.

internal/config/load.go

@@ -15,9 +15,9 @@ import (
 // (logging.level to LOGGING_LEVEL, once upper-cased).
 var envKeyReplacer = strings.NewReplacer(".", "_")
 
-// envVarName returns the environment variable that sets key, e.g.
+// EnvVarName returns the environment variable that sets key, e.g.
 // JOBSEARCH_LOGGING_LEVEL for logging.level.
-func envVarName(key string) string {
+func EnvVarName(key string) string {
 	return EnvPrefix + "_" + strings.ToUpper(envKeyReplacer.Replace(key))
 }
 
@@ -29,7 +29,7 @@ func isExplicitlySet(key string) bool {
 	if viper.InConfig(key) {
 		return true
 	}
-	value, ok := os.LookupEnv(envVarName(key))
+	value, ok := os.LookupEnv(EnvVarName(key))
 	return ok && value != ""
 }