[Security] API Key Transmitted in Header for Unauthenticated Endpoints

## Bug Name
API Key Transmitted in Header for Unauthenticated Endpoints

## Attack Scenario
The API constructor sets X-MBX-APIKEY header on the session for ALL requests. This means the API key is sent even for public endpoints like ping(), time(), exchange_info(), depth(), trades(), klines(), etc.

## Impact
Unnecessary API key exposure on public endpoints increases attack surface. If traffic is intercepted, API key is leaked even when user only intended to fetch public market data.

## Components
File: /binance/api.py, lines 45-52 (session.headers.update with X-MBX-APIKEY). All public endpoints via query() -> send_request() inherit this header.

## Reproduction
1. Configure client with API key.
2. Call any public endpoint like ping() or klines().
3. Inspect request headers -- X-MBX-APIKEY is present.

## Fix
Only include X-MBX-APIKEY header for limit_request() and sign_request() methods, not in session-level defaults.

## Details
Finding ID: M-03
Severity: Medium

---
Researcher: Independent Security Researcher -- Mefai Security Team