Point API-key docs to secrets.yml

[liquidsec]

Closes #3270.

A few sections of the docs still directed users to put API keys in
bbot.yml when they belong in secrets.yml (which is what
api_key: str = Field(..., sensitive=True) and the auto-generated
template both dictate).

Verified against the code:

• Both bbot.yml and secrets.yml are auto-created on first run
  (ModuleLoader.ensure_config_files).
• secrets.yml is loaded after bbot.yml and overrides it on
  conflict (get_custom_config -> deep_merge(bbot.yml, secrets.yml)).
• The auto-generated secrets.yml template is built from
  secrets_only_config(), which filters to fields marked
  sensitive=True (i.e. api_key, etc.).

Files updated:

• README.md (the line called out in the issue)
• docs/index.md (API keys section)
• docs/scanning/configuration.md (intro, file list, and the
  shodan_dns.api_key example; the http_proxy example is left in
  bbot.yml since it's not sensitive)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90%. Comparing base (0a83067) to head (d5d0efe).
⚠️ Report is 54 commits behind head on dev.

Additional details and impacted files

@@          Coverage Diff          @@
##             dev   #3283   +/-   ##
=====================================
- Coverage     90%     90%   -0%     
=====================================
  Files        450     450           
  Lines      46155   46155           
=====================================
- Hits       41409   41408    -1     
- Misses      4746    4747    +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.