config: support reloading config.yaml via fsnotify watcher

What is the underlying problem you're trying to solve?

config.yaml is read once at startup and never re-read.

If users are not using discovery bundles, any config file change needs a restart. In sidecar deployments this means restarting the whole pod, causing downtime to change settings.

Describe the ideal solution

opa run -c config.yaml -w watches the config.yaml as well, and applies changes, the same way the server already watches TLS cert/key/cert-pool files and reloads them without a restart.

We could also consider SIGHUP handling for config reloading.

Additional Context

Related: #3605.