Add a [secrets_files] section to aplication configs

[EternityForest]

In #442, they mention splitting applications by location, and the issue seems to have been close due to complexity.

But what about a more limited version, just allowing application config to declare secrets files, and giving a single global secrets location option?

Even just having a flag to treat secrets files like normal files would be very useful, if you're already only storing dotfiles in an encrypted sync folder.