Move config mistrust checking to load

Currently mistrust checking for the config files is done while constructing the ConfigurationSources (our helper type for driving config-rs).

@nickm and I discussed this on IRC.

We think this should be done in ConfigurationSources::load. !495 (merged)'s from_cmdline would then no longer throw fs_mistrust::Error.