Event managers should not see global API keys

[maswan]

An event manager should be able to set their own event account (API keys + org_name), but not see the globally configured API keys. Suggested method for this would be to have separate fields&variables (event_sec_key etc), and use the event ones if set.

[bow]

All right, 4806996 implements this change. There is now a checkbox in the event form, which if set to true will ask for the event manager to input the secret and publishable keys. If not checked (the default one), the global API keys will be used but the event manager can not see them. (Well, technically, the publishable key is viewable from the HTML page, but that's as it is meant to be).

The publishable key in the template have also been update to ensure the right key is used, so event keys should never be mixed with global keys. I've also added some tests for this.

So for now I'm closing this ticket. Feel free to reopen, as needed.