fix: Decouple JWT signing key from user password hash

[hengyuss]

#6398

decouple jwt signing key from user password hash

add secret-key in application.yml to configure the key of jwt secret key, the code will generate a random string as secretKey if user doesn't configure it.

i don't update JwtUtils.generateToken() and JwtUtils.verifyToken() . the two function receive the argument as secretKey and i think the behavior is correct. So that i change two place that invoke these two funcitons.
Make sure that:

• You have read the contribution guidelines.
• You submit test cases (unit or integration tests) that back your changes.
• Your local test passed ./mvnw clean install -Dmaven.javadoc.skip=true.

[Aias00]

The @PostConstruct init generates a SecureRandom secretKey per JVM when shenyu.jwt.secretKey is not explicitly configured. In a multi-instance Admin cluster this causes tokens signed by instance A to fail verification on instance B, resulting in random 401s for dashboard users. Consider either failing fast (throw new IllegalStateException) to force explicit configuration, or persisting the generated key somewhere shared across the cluster.