feat(contrib): add ping key revocation helper

- Add make_ping_key_revocation.py: onion revocations are signed by the
  identity key, DNS TXT revocations are self-signed by the revoked key
- Document the revocation format, endpoint, helper usage, lifetime and
  no-revocation-of-identity-key limits
- Update the security audit, references and env docs for the new flow and
  the v2/onion-only scope

.gitignore

@@ -54,6 +54,8 @@ download_bal_db.sh
 # Misc
 *.swp
 *.swo
+__pycache__/
+*.pyc
 src/xpub.rs2
 public_key.pem
 .gitsecret/