feat: nodkey broker check — check a config without starting the broker #173

Why

A tool that changes the broker config from git must check a new config
before it is applied (#102). Today there are two checks, and neither
fits:

• a start of the broker. A bad config is found only when the broker
  fails to start;
• nodkey doctor broker --config FILE. It loads the config without
  starting, but it runs as root and also checks the live host: the unit,
  the credentials, swap, the service. It also reads the files that the
  config names at their absolute paths, so a new config is checked with
  the old known_hosts.

This issue takes the config part of doctor broker into its own command.

Wanted

nodkey broker check --config FILE [--files DIR]:

• runs every check that a start runs, on the given file and the files it
  names (known_hosts and others), then exits; it starts nothing and
  opens no port;
• with --files DIR, reads the files that the config names (such as
  /etc/nodkey/known_hosts) from DIR, by base name, instead of their
  absolute paths. So a new config is checked with its own new files, also
  in CI, where /etc/nodkey/ does not exist;
• prints each problem in plain words, and exits 0 when the config is good,
  1 when it is not, and 64 on wrong usage (as nodkey doctor does);
• runs as an unprivileged user with no access to the credentials.
  A check that needs a credential (a ${CREDENTIALS_DIRECTORY}/ path)
  says "skipped: needs the credential". With --credentials DIR, it
  checks only that a file with that name exists in DIR.

Done when

• The command exists, with the exit codes above.
• It runs the same check code as a start (one code path, not a copy).
  A test proves that a config the start refuses is also refused by
  the check. nodkey doctor broker uses the same code for its config
  part.
• With --files DIR, a known_hosts in DIR is used, and the one at
  the absolute path is not read. A test.
• It does not need root, the credentials, or the network. Tests.
• docs/setup.md section 7 shows it.

Related: #102 (config changes without SSH), #29 (reload without a
restart), and #174 (config-diff).