Clarify permissions attached to per-repository API keys

[jcushman]

API keys look like they are created per-repository, but really they are created per-user. It would be good (one way or another) for the interface and the permissions attached to keys to match.

For example, here is a new repository with no keys:

This repository can still be written to, because keys created for other repositories are able to write to it.

And, even more unintuitively, keys created for a repo belonging to a user can be used to write to another repo belonging to an organization they're part of.

I think it's a good idea for permissions attached to keys not to be surprising, so I would update the interface to match the intent:

• If the intent is for a user to have one or more keys they use for all their repositories, I would manage keys on a user-level page instead of a repo-level page, and just have the Manage Repo page link to that.
• If the intent is to have repo-level keys, I would have them not have permissions for other repos.

I didn't test how this works for multiple users of an org repo, but I would figure out something for that too: can all users see the same keys, or are they per-user?