Add sops config subcommand to print matched .sops.yaml rules as JSON

[djgoku]

Summary

sops config <file> prints the .sops.yaml rules (creation and
destination) that apply to a given file path, as JSON. Useful for
previewing which keys would encrypt a file, debugging which path_regex
rule wins, and tooling integration. Only the path is used — the file
does not need to exist on disk.

Example

$ sops config example.yaml
{
  "schema_version": 1,
  "config_path": "/path/to/sops/.sops.yaml",
  "file_path": "/path/to/sops/example.yaml",
  "creation_rules": [
    {
      "rule_index": 0,
      "path_regex": "",
      "pgp": [
        "FBC7B9E2A4F9289AC0C1D4843D16CEE4A27381B4",
        "D7229043384BCC60326C6FB9D8720D957C3D3074"
      ],
      "shamir_threshold": 0,
      "unencrypted_suffix": "",
      "encrypted_suffix": "",
      "unencrypted_regex": "",
      "encrypted_regex": "",
      "unencrypted_comment_regex": "",
      "encrypted_comment_regex": "",
      "mac_only_encrypted": false
    }
  ],
  "destination_rules": []
}

With --require-match, exits with new codes.NoRulesMatched (62) when
no rule applies, while still printing the empty JSON.

Related

Partially addresses #1758 — the no-match case is now introspectable via
sops config even though filestatus itself is unchanged.