This PR completes the deprecation of external service tokens to be used with batch changes.
From now on, all `ChangesetSources` returned from `Sourcer` methods are ensured to be properly authenticated with either a site credential or user credential, where applicable. This will also make sure that we will never accidentally use other tokens. That also means that we don't need so strict constraints on the external service anymore, so we can simply read the `repo.Sources.CloneURL` field and don't have to check if an external service has a token configured. Overall, the logic got much simpler and I was able to eliminate many now redundant tests, as they all just use the already tested sourcer methods now.