swarmctl: add bao init and bao grant-bootstrap

init prints the store's keys and root token once and keeps none; with
--and-grant it goes on to the granter bootstrap in the same process.
grant-bootstrap does that step alone, reading the root token from a
hidden prompt or stdin. The token reaches bao only as BAO_TOKEN in the
child's environment.

swarmctl/Cargo.toml

@@ -40,6 +40,7 @@ swarm-controller-api.workspace = true
 swarm-wire.workspace = true
 tokio.workspace = true
 url.workspace = true
+zeroize.workspace = true
 
 [lints]
 workspace = true