Document restricted API key permissions

This fleshes out the installation documentation. If you have feedback about these permissions being too permissive, let me know and I'll correct it!