rfc(feature): Option for organizations to disallow use of user API tokens

[mdtro]

Provide a toggle option for organizations to disallow the use of user API tokens when authenticating to their organization.

Rendered RFC

[mitsuhiko]

Generally a big fan of this idea. However I think we probably need to revisit some of our user experience around the tokens. The work for source maps recently also surfaced again that user bound tokens are also not idea from a user experience point of view.