Added config generate-csrf-key, to store a CSRF key that survives restarts and works across instances

Without server.csrf.tokens.key, each server process signs CSRF tokens with
a random key of its own, so tokens are lost on a restart and rejected by
other instances. "job-search config generate-csrf-key" stores a new random
32-byte hex key in the configuration file, without printing it. --print
only prints a key, for JOBSEARCH_SERVER_CSRF_TOKENS_KEY or another
instance. An existing key is only replaced with --force, as that
invalidates every issued token, and no key is stored while
JOBSEARCH_SERVER_CSRF_TOKENS_KEY is set, as it would override the file.

internal/config/load_test.go

@@ -200,8 +200,8 @@ func TestEnvVarName(t *testing.T) {
 		"server.websocket.connection_limit.enabled": "JOBSEARCH_SERVER_WEBSOCKET_CONNECTION_LIMIT_ENABLED",
 	}
 	for key, want := range tests {
-		if got := envVarName(key); got != want {
-			t.Errorf("envVarName(%q) = %q; want %q", key, got, want)
+		if got := EnvVarName(key); got != want {
+			t.Errorf("EnvVarName(%q) = %q; want %q", key, got, want)
 		}
 	}
 }