batches: emphasize distinction between PAT and global credentials in docs
Created by: courier-new
Closes #21715 (closed). Maybe closes #21889 (closed) too??
Documents that a global service account token is required to import and sync changesets and clarifies the hierarchy between the personal access token and the global credentials in a couple places.
I also moved the deprecated and now-removed fallback for admins for the Sourcegraph external services token to the bottom of the "Configuring credentials" page and updated the warning about not using it.