[Feature] use systemd-credentials on the consumer-side to securely store secrets and manage access

[con-f-use]

Systemd-credentials are a way to securely store passwords on a machine. The machines TPM (or software stand-in) handles encryption while systemd handles access management on the machine.

The mechanism is already used by many NixOS modules, e.g. forgejo