feat!: replace plain-text DRF token with PBKDF2-hashed API token

[tdruez]

Changes

• migrate from DRF authtoken to aboutcode.api-auth
• New APIToken model that stores an encoded PBKDF2 hash of the key
• A data migration that encode existing authtoken.Token into the new model
• Refined UI to generate and present the API key in the profile view
• The API key is only available once when generating it, the plain key is never stored. If a key is lost, it needs to be regenerated.