So far every user on the system was able to read the secrets from the
world-readable config.json. Move these secret into the systemd service
file and limit its read rights to root.

fixes: archlinux/infrastructure#562



Co-authored-by: Jakub Klinkovský <lahwaacz@archlinux.org>
Signed-off-by: Christian Heusel <christian@heusel.eu>

This allows the pads to be named nicely instead of having just a random string as URL.

For example the draft of the monthly report in july could be located at "https://md.archlinux.org/2023-07_monthly-report" instead of "https://md.archlinux.org/UF9Y235qTRe8XS3qxUVeJA".

https://docs.hedgedoc.org/references/url-scheme/#freeurl-mode



Signed-off-by: Christian Heusel <christian@heusel.eu>

From [1]: "By default, the new Quarkus distribution removes /auth from
           the context-path."

[1] https://www.keycloak.org/migration/migrating-to-quarkus

This adds a collaborative markdown editor as newly offered service which
is available via login for all Arch Linux Staff with an option to allow
anonymous edits by users (not default). Users are managed via keycloak
and require the Staff role to be allowed in, non staff keycloak users
currently will receive an internal server error due to an upstream
issue.