supporters: Document "restricted API key" required permissions

conservancy/supporters/views.py

@@ -195,6 +195,9 @@ def sustainers_stripe(request):
     return render(request, 'supporters/sustainers_stripe.html', {'form': form})
 
 
+# Use a "restricted" API key and grant access to:
+# - checkout sessions (write)
+# - credit notes (read) - unclear why, subscription sign-ups fail otherwise
 stripe.api_key = settings.STRIPE_API_KEY
 if stripe.api_key == '':
     logger.warning('Missing STRIPE_API_KEY')