Name the setting keys searxng, keycloak and betterbird files take (hq issue 168, ADR 0326)

Every setting reached every mergeable file: searxng's endpoints landed in
its settings.yml, keycloak's issuer in its tools' config, betterbird's
prefs would land in its accounts file. Each file now names the keys it
reads, so the controller lays only those over it and calls the rest
stray. Merge only after the controller that knows takes-settings
(mesh-controller #272) has walked: an older one hands the field to the
node-engine, which refuses it.

modules/betterbird/module.json

@@ -52,6 +52,9 @@
       "owner": "${machine:account}",
       "mode": "0600",
       "merge": "json",
+      "takes-settings": [
+        "accounts"
+      ],
       "content": "{\n  \"accounts\": {}\n}\n",
       "trusted": true
     },

modules/keycloak/module.json

@@ -162,7 +162,13 @@
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{}\n",
-      "merge": "json"
+      "merge": "json",
+      "takes-settings": [
+        "url",
+        "user",
+        "realm",
+        "issuer"
+      ]
     }
   ],
   "build": {

modules/searxng/module.json

@@ -76,6 +76,18 @@
       "path": "${dir:state}/settings.yml",
       "mode": "0600",
       "merge": "json",
+      "takes-settings": [
+        "general",
+        "brand",
+        "search",
+        "server",
+        "ui",
+        "outgoing",
+        "engines",
+        "plugins",
+        "categories_as_tabs",
+        "preferences"
+      ],
       "content": "{\n  \"use_default_settings\": true,\n  \"server\": {\n    \"secret_key\": \"${secret:secret}\",\n    \"base_url\": false,\n    \"limiter\": false,\n    \"image_proxy\": false,\n    \"public_instance\": false\n  },\n  \"search\": {\n    \"formats\": [\"html\", \"json\"]\n  },\n  \"valkey\": {\n    \"url\": \"valkey://valkey:6379/0\"\n  }\n}\n"
     },
     {