Horizon: Move secrets out of config.toml

[deontologician]

It seems reasonable to be able to commit your config.toml file to source control, since configuration is part of your app. But you can't because it has secrets in it. I propose we move secrets out to something like secrets.toml, do all the permissions stuff we do now on config.toml, and add do #454 with a .gitignore that prevents it from being checked in.

[mglukhovsky]

Could we name the file config.secrets.toml, so it's clear they're secrets related to config.toml?

[mlucy]

+1 for moving them out. IMO secrets.toml is better than config.secrets.toml and plenty clear.

[deontologician]

This is done in 2.0.0