swarmctl: add bao init and bao grant-bootstrap

init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.

Cargo.lock

@@ -5369,6 +5369,7 @@ dependencies = [
  "swarm-wire",
  "tokio",
  "url",
+ "zeroize",
 ]
 
 [[package]]