Read a config file as JSON, or write one from it.
Uses js-yaml in safe mode, so custom tags that could construct arbitrary objects are rejected rather than executed.