security: warn if api_key given in config and config is world-readable

[leondz]

Summary

If a parsed config file contains an api_key value, test if that config file is world-readable. If it is, print a warning.

Basic example

config.yaml, chmod 777

---
plugins:
  generators:
    openai:
      api_key: oh no

output:

$ garak --config config.yaml
🛑 the specified config "config.yaml" contains a secret but can be read by anyone. change its permissions.

Motivation

Help our users be less insecure