Document the module in README.md for subscribers, site builders, operators, connector maintainers and developers

One more README commit landed against this issue before it closes, on the #3630969: Refuse an upgrade while a period charge is open or the subscription is past due, and validate the currency on plan change MR (merge request 33), since commit e41b3bf on 1.0.x added Tool API integration (src/Tool/SubscriptionTools.php, service subscription_manager.tools) with no README coverage. The commit adds:

• A line under Requirements: Tool API is optional, like Token.
• A "Tool API tools" subsection under the site-builder section listing the five tools with the permission or access check each one has (list_plans and sync_plans: Administer Subscription plans; list_overdue_subscriptions: Administer Subscription entities; refresh_subscription: update access on the subscription; list_user_subscriptions: administrators for anyone, a subscriber for themselves), that none moves money or changes a subscription, that the result fields are the curated ones the JSON endpoints use, that refresh and sync make one unthrottled remote call per invocation (#3629972: Dedupe and rate-limit the remote calls made on registration, login and the subscribe and portal routes), and that the attributes are inert without Tool API.
• A line under Permissions: list_user_subscriptions takes the user as an entity input with a view check, so a subscriber listing their own subscriptions also needs core's Access user profiles. Documented rather than changed; relaxing the check for the self case would be a small follow-up if wanted.

The beta7 release notes should name the feature too, since it shipped on 1.0.x between the audit rounds.