Generate WP_SECRETS_KEY in wp config create for the WordPress 7.2 Secrets API #234

Feature Request

WordPress 7.2 adds a Secrets API, for storing credentials such as API keys encrypted at rest (#66187). The encryption key comes from a new constant in wp-config.php:

define( 'WP_SECRETS_KEY', '<base64-encoded random 32 bytes>' );

Core is about to make that constant required: without it, the Secrets API can't store or read secrets (PR 15258). setup-config.php will generate it during the web install (#66399, PR 15124). wp config create writes its own file, so installs made with WP-CLI won't get a key unless it generates one too.

Proposal:

1. wp config create generates WP_SECRETS_KEY.
   • The value is base64_encode( random_bytes( 32 ) ), the form core uses as raw key material.
   • It goes after the closing /**#@-*/ of the keys-and-salts group, matching core. The group's docblock says the salts can be changed at any time, and this key must not be.
   • It's written whatever the WordPress version, like WP_CACHE_KEY_SALT. Older versions ignore it.
2. A new --skip-secrets-key flag turns it off. It's a separate flag from --skip-salts, because the test suites pass --skip-salts to every install.
3. A key passed in --extra-php is kept. If --extra-php already defines WP_SECRETS_KEY, no second key is added.
4. wp config shuffle-salts WP_SECRETS_KEY refuses. Changing the key makes every stored secret unreadable. Today shuffle-salts WP_SECRETS_KEY --force would replace it with a 64-character salt. Plain wp config shuffle-salts already touches only the eight salts, so that stays as it is.

I have a PR ready and will link it here.