pub fn secrets_dir(config_dir: &Path) -> Result<PathBuf, Box<dyn Error>>Expand description
Resolve the per-config bootstrap secrets directory, creating it on first
use with owner-only permissions (0700 on Unix, user-only DACL on
Windows via icacls). See crate::secure_file::restrict_dir_to_owner.