feature: add support to read certificate private keys from file-system

Certificates are sensitive and can't be stored in plain-text.
In most use-cases, decK runs in a CI pipeline. In such a system, certificate private key and certificate can be provided to decK during runtime by CI via a file.
This avoids storing the certificate's private key in plaint-text in decK's state file.

The issue names no files, tests, or entry points. Start by tracing how decK currently reads certificate fields and writes its state file, then determine the runtime file-input interface and affected configuration paths. Done means private keys can be supplied from files without being stored in plain text in the state file, with coverage for the new behavior.

Written by the indexing model from the issue text.