feat(secrets): extract KeySource trait + FileKeySource backend (#9194)