Add Scaleway Secret Manager backend

[b4nst]

Summary

• Add Scaleway Secret Manager as a new backend provider (type = "scaleway")
• Bump Go to 1.25, update all nix flake inputs and Go dependencies
• Fix security issues: file permissions, debug output leak, temp file cleanup

Scaleway backend

• Registered as builder type scaleway, auto-discovered via init()
• Config: region (required), project-id (required), credentials from env/scw config
• Uses AccessSecretVersionByPath for efficient Get, ListSecrets + CreateSecret/CreateSecretVersion for Set, lookup + DeleteSecret for Delete
• Client interface extracted for testability, 13 tests covering all paths
• See Support storing Scaleway credentials in OS keychain (system store) #84 for future keychain credential storage support

Security fixes

• FileStore file permissions 0644 → 0600
• Config file permissions 0660 → 0600
• Removed debug fmt.Println leaking filesystem paths
• Added temp file cleanup for config editing
• Removed plaintext credentials from example config

Test plan

• All existing tests pass (go test ./...)
• 13 new tests for Scaleway backend (builder validation, Get/Set/Delete with mocks)
• Manual testing with a Scaleway account