config: let the on-disk backend fail to load gracefully

Failure to read certain paths can be a common misconfiguration on many
systems and we do not always want to fail in those cases.

Let the on-disk backend fail to load and create an empty one, as could
be the case for a privilege-dropping application which does not update
its $HOME from the privileged user.
repository: allow the global and system configs to fail loading

Common misconfigurations on the server side means that $HOME may point
to the privileged use the application was running as before it dropped
privileges. Similarly, the system config file may not always be
readable.

Allow for reading both of these configurations to fail. This fixes #2122.