fix: keep tenant config out of config.php

[YvesCesar]

Problem

On a multi-tenant instance, any system config write flattened the current tenant's values into the instance-wide config.php, permanently.

OC\Config::readData() merges every config/*.config.php into $this->cache without recording where each key came from, and writeData() dumps that whole cache with var_export(). So a single occ config:system:set foo bar served
under a tenant host also rewrote mail_smtphost, trusted_domains and every other key the tenant defined — as global config.

Writing config is not something an admin has to ask for: an upgrade alone writes config.php about six times (Updater sets maintenance, loglevel, installed, version), and maintenance:repair, the admin mail form and background jobs such as updatenotification/ResetToken do the same. A cron running under one tenant was enough to overwrite the base config for everyone.

What changes

The loader body moves to src/loader.php, included from config/multitenancy.config.php inside OC\Config::readData(), so it runs in the config class scope ($this is the OC\Config instance).

Tenant values are injected into $this->envCache — the channel behind the NC_* environment variables. Nextcloud reads it with priority and writeData() never persists it, so tenant config cannot reach config.php at all. Unlike real NC_* variables, which getenv() only delivers as strings, this channel accepts arrays and booleans.

Array values are merged over the base with array_replace_recursive, the same rule Nextcloud applies to every *.config.php. Lists merge by index, so tenant trusted_domains must be written in full.