removed strip secret key from config, revocked the key

.env.example

@@ -25,3 +25,9 @@
 
 # Another common use case is to set Drush's --uri via environment.
 # DRUSH_OPTIONS_URI=http://example.com
+
+# Stripe secret key for the "stripe" commerce payment gateway. Kept out of
+# config/sync (which ships an empty secret_key) and injected in settings.php
+# via getenv('STRIPE_SECRET_KEY'). Use a live key in production, a test key
+# (sk_test_...) everywhere else.
+# STRIPE_SECRET_KEY=

config/sync/commerce_payment.commerce_payment_gateway.stripe.yml

@@ -15,7 +15,7 @@ configuration:
     - credit_card
   collect_billing_information: true
   publishable_key: pk_live_51I7RAuBp8BkjanLQp3lsf7QBqO1xhRj8gLEbH4ivBEiZhkGwxgrQNGGizo5yk7HgxkiW3jRY6M4ni8pVfBTt5DGW00nBUevKbl
-  secret_key: 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
+  secret_key: ''
   enable_credit_card_icons: false
 conditions: {  }
 conditionOperator: AND