Generate APP_SECRET in .env.local when missing

[nicolas-grekas]

The demo app needs an APP_SECRET because it uses ESI, fragments and remember-me, which all need a secret.

Instead of hardcoding a secret in .env, I propose here to generate one in .env.local on composer i/u when it's missing.

Inspired by the discussion on #1529 (comment)

[javiereguiluz]

This proposal is smart, but I think it's convoluted for the Demo application. Also, it introduces a new "moving part" that could fail.

Is it really wrong to ship this Demo application with a predefined value in APP_SECRET as we've done since day one?

[nicolas-grekas]

Closing in favor of #1532