store API keys privately for use in file sources and fetch chunks (and etc?)

quoth @teonbrooks in https://github.com/iodide-project/iodide/issues/1976#issue-461202796
"as a user, I would like to be able to store my secret keys for use in some web api calls. currently, the api key is exposed in the Iodide notebook. this would be useful internally for accessing Bugzilla to retrieve private bugs. Something similar to how Glitch stores private keys would be nice"