feat(self-hosted): do not require openssl or node for new auth - #45941

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docker/utils/add-new-auth-keys.sh`:
- Around line 60-63: The script currently reads the JWT secret from
process.argv[1] (see the node runner invocation and the jwtSecret variable),
which exposes the secret on the process command line; change the Node script to
read the secret from stdin instead (e.g., read process.stdin until EOF and
assign to jwtSecret) and update the docker/node runner invocation to pass the
secret via stdin (enable -i on the runner) so the secret is never passed as a
command-line argument; apply the same change to the other occurrence around the
second instance (line ~134) that also uses process.argv.
- Around line 22-37: Update the runtime selection to verify the local node
version (require >=14.18.0 or your preferred minimum, e.g., >=16) before
choosing "node" so older local Node will not be used; if the version check
fails, fall back to the containerized runner by setting node_runner to the
existing "docker run --rm node:22-alpine node" path (this affects the
node_runner assignment logic in the shown block and should be mirrored in
rotate-new-api-keys.sh). Also stop passing JWT_SECRET as a positional argument
to the Node script (the invocation that currently supplies JWT_SECRET on
process.argv); instead provide the secret via a safe channel such as an
environment variable (export into the shell and use process.env.JWT_SECRET in
the Node script, or pass it into the docker run with --env and read
process.env.JWT_SECRET) or via stdin, and remove the JWT_SECRET positional
argument so it no longer appears in the process list.