batches: use user tokens when syncing changesets

Created by: LawnGnome

Don't worry, most of this PR is mocks by weight. The actual change is pretty straightforward: we unify the logic used to authenticate a ChangesetSource in the reconciler and syncer, which means the syncer now gets the same "try the user credential first" behaviour we want. I'm particularly pleased that the reconciler unit tests didn't have to change at all, even though the underlying implementation was rewritten.

The unit tests are somewhat duplicative between sources and syncer, but given how important this is to the entire Batch Changes feature, I'm OK with that. The syncer tests are maybe a little more integration. Note that I didn't change the existing imported changeset syncer tests, even though their indentation changed, so that's why they look a little old school.

This should also give us a clearer path to removing the global token fallback (#25394 (closed)), since it's now essentially in one place only.

Closes #33413 (closed).

Test plan

Added lots of unit tests, and ran some smoke tests locally to ensure syncing still works as expected across our four supported code host types.