Create internal access tokens for executor job and use in batch changes

Created by: mrnugget

This is part of https://github.com/sourcegraph/sourcegraph/issues/24421 and fixes https://github.com/sourcegraph/sourcegraph/issues/22763 (see for more details).

Short version: we need to create access tokens that are (a) temporary and (b) not visible to users. They're only used by src-cli running inside executor talking to the Sourcegraph API.

What this PR does:

1. Add an internal flag to access_tokens and the necessary methods to create internal flags without them showing up in the UI.
2. Change the server-side batch changes job so that a new internal access token gets created whenever we run an executor job and that it gets cleaned up when the job is done.

The first point is why I tagged @sourcegraph/backend-devs devs here and the second point is why I tag @sourcegraph/batchers to review.