Require known Stripe API keys in strict mode

• Add stripe.strict_scopes: on /v1 routes, a request without an API key or with a key that does not come from seed config or server options returns 401 with Stripe's invalid_request_error messages.
• Accept the key as the HTTP Basic username or a bearer token, and keep accepting any key by default, with regression coverage and docs.

References:

• The key as the Basic username or a bearer token, and requests without authentication failing: https://docs.stripe.com/api/authentication
• "401 Unauthorized: No valid API key provided.": https://docs.stripe.com/api/errors
• 401 with invalid_request_error for an invalid or missing key in Stripe's mock server: https://github.com/stripe/stripe-mock/blob/master/server/server.go
• Live responses: Invalid API Key provided: <key> (https://github.com/stripe/stripe-node/issues/950) and You did not provide an API key. ... with WWW-Authenticate: Basic realm="Stripe" (https://github.com/stripe/stripe-terminal-android/issues/582)

Fixes #374