Should have a way to use API keys without sending them to the LLM

[wch]

Many useful applications use web APIs which require an API key. Currently, the only reasonable way to use a key is to have a password input for the API key, but then each time the app is restarted, it requires filling in the API key again.

If the API key is stored in a file like .env, then that file would be sent to the LLM each time the user sends a message.

One way to do this is to have the shinylive window just not send files that start with . to the parent window when the parent requests the current files.