Deprecate external service tokens in batch changes in 3.29

Created by: eseliger

To fully make campaigns separate from the external service configs, I think we should want to migrate the syncer away from using their tokens. Instead, we should want to import and sync using the users token.

The problem: What user are we getting the token from? For changesets published by campaigns, this is currently pretty simple: The last applier of the owning campaign is the token donor. That connection is: changeset->owning_campaign->last_applier

For imported changesets, however, we don't have this kind of connection. What we could do:

We use changeset->campaigns->last_appliers, which would be all last appliers for all the campaigns the changeset is tracked in. That, however, would be hard to fix for users when one of the last_appliers has a bad credential stored, for example. Currently, we don't even expose syncer errors so it would be hard to debug for users. It certainly isn't any worse than the current state, so I think we might still want to do that as a short-term fix, but we should ultimately try to find a better solution - as a follow-up item.