feat(config): support env substitution

[AkashKumar7902]

Summary

• expand environment variables in zot config string values using $VAR and ${VAR}
• apply the same substitution to referenced LDAP, OpenID/OAuth2, and session key secret files
• fail config loading when a referenced environment variable is unset
• document the syntax in examples/README.md

Fixes #2521

Validation

• GOEXPERIMENT=jsonv2 go test ./pkg/cli/server -count=1
• git diff --check

[Copilot]

Pull request overview

This PR adds environment variable substitution for string values in zot configuration files (supporting $VAR and ${VAR}), extends the same substitution behavior to referenced secret/config files (OpenID/OAuth2 credentials, LDAP credentials, session keys), and documents the syntax with an accompanying test suite update.

Changes:

• Introduce a Viper/mapstructure decode hook that expands $VAR / ${VAR} in all string fields and fails config loading when referenced env vars are unset.
• Apply the same substitution to referenced secret files by adding the hook during secret-file unmarshalling.
• Factor config-file reading (including extensionless-file probing) into a shared helper and document the new behavior in examples/README.md.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
pkg/cli/server/root.go	Switches to shared config reader; applies env-substitution decode hook to main config and secret-file loading.
pkg/cli/server/root_test.go	Adds coverage for env substitution in main config + OpenID credentials file, and failure on missing env var.
pkg/cli/server/config_loader.go	Adds shared config-file reader and env expansion implementation used via decode hook.
examples/README.md	Documents env var substitution syntax and behavior.

Comments suppressed due to low confidence (1)

pkg/cli/server/root.go:1258

• When env substitution fails, the decode hook returns an error that already wraps zerr.ErrBadConfig. Returning errors.Join(zerr.ErrBadConfig, err) here will duplicate the ErrBadConfig message (errors.Join concatenates messages), producing user-facing errors like "invalid server config\ninvalid server config: …".

	if err := viperInstance.Unmarshal(v, metadataConfig(metaData), viper.DecodeHook(envSubstitutionDecodeHook())); err != nil {
		logger.Error().Err(err).Str("path", path).Msg("failed to unmarshal secret file config")

		return errors.Join(zerr.ErrBadConfig, err)
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.