Stripe: strict mode to reject requests without a valid API key

Problem

Stripe authenticates requests with the API key as the HTTP Basic username or as a bearer token, and "API requests without authentication also fail" (https://docs.stripe.com/api/authentication), with "401 Unauthorized: No valid API key provided." (https://docs.stripe.com/api/errors). Stripe's own mock server answers an invalid or missing key with 401 and an invalid_request_error (https://github.com/stripe/stripe-mock/blob/master/server/server.go), and live responses show the messages Invalid API Key provided: <key> (https://github.com/stripe/stripe-node/issues/950) and You did not provide an API key. ... with WWW-Authenticate: Basic realm="Stripe" (https://github.com/stripe/stripe-terminal-android/issues/582). The emulator accepts any request, with or without a key, so a test asserting that a revoked or wrong key fails cannot represent it.

Proposal

• Add stripe.strict_scopes, matching the other services' settings: on /v1 routes, a request without a key returns 401 with You did not provide an API key. ... and WWW-Authenticate: Basic realm="Stripe", and a key that does not come from seed config or server options returns 401 with Invalid API Key provided: <key>, both as invalid_request_error.
• Accept the key as the Basic username or a bearer token, keep the hosted checkout pages public, and keep accepting any key by default.

Implementation

A working version with tests and docs is on a fork branch: https://github.com/Unchallenged-com/emulate/tree/stripe-strict-api-keys. Happy to open a pull request for it.