API Secret support for imports

The supported method for authenticating import() calls (for events more than 5 days old) is now via the project's API Secret, passed via the secret config option:

const mixpanel = Mixpanel.init(`<TRACKING TOKEN>`, {secret: `<API SECRET>`});

This will be passed as a HTTP Basic auth header as described in https://developer.mixpanel.com/reference/importing-old-events. It will only be sent over HTTPS (the default protocol); the library will throw an error rather than send the secret over HTTP in plaintext.

The older API "Key" authentication for import will still work, but is now deprecated and may be removed in a future version.