Keep every password, token and API key the vault's, never a setting (hq issue 342)

A setting outranked the vault: baserow, grafana, letta and unifi merged a layer's
password over the ${secret:...} in their runtime config, and the gitea,
home-assistant, icecast, influxdb, mailu and nextcloud clients read the settings
file before the vault's file. A secret in a setting cannot be rotated and is read
back by the settings verb.

The four files now keep their password protected, so the controller refuses a
setting of it. The six clients ignore a secret in the settings file and say so
once, by key and never with the value; icecast reads its admin password from the
vault's file. checks/secrets refuses a mergeable file whose secret a layer could
replace; searxng's nested server.secret_key is listed as known until the
controller protects a nested key.

modules/unifi/module.json

@@ -131,7 +131,8 @@
       "path": "${dir:mesh-state}/config.json",
       "mode": "0600",
       "content": "{\n  \"site\": \"default\",\n  \"password\": \"${secret:controller}\"\n}\n",
-      "merge": "json"
+      "merge": "json",
+      "protected": ["password"]
     }
   ],
   "requires": [