Ability to whitelist traits for client SDKs

Users should be able to configure a whitelist of trait_keys that can be set using client side API keys. This should be taken into account when allow_client_side_traits is `true`.

Start by tracing where client-side API keys, allow_client_side_traits, and trait_keys are handled in the Python backend. Look for existing tests covering client-side traits and API-key permissions. Done means a configured whitelist limits which traits client SDKs can set when allow_client_side_traits is true, with tests covering allowed and rejected trait keys.

Written by the indexing model from the issue text.