Restrict `Token` authentication in Core API

In #6626, we add drf-spectacular extensions to describe our authentication classes. As a result, the following security schemes are included in the OpenAPI spec:

```yaml
basicAuth:
type: http
scheme: basic
tokenAuth:
type: apiKey
in: header
name: Authorization
description: Token-based authentication with required prefix "Token"
```

Apparently, the `tokenAuth` scheme can be used against our SaaS, as evident from the latest outage when the `Token`-prefixed requests were ignored by our WAF rule. Most likely this is due to including `"rest_framework.authentication.TokenAuthentication"` in DRF's `DEFAULT_AUTHENTICATION_CLASSES` setting.

The goal of this task is to:
1. Remove `"rest_framework.authentication.TokenAuthentication"` from the settings. Make sure the tokens can only be used as cookies.
2. Probably, remove the `ENABLE_COOKIE_AUTH` setting as the cookie auth is a de-facto default for Flagsmith UI.
3. Trace the `basicAuth` scheme, and remove if it's not viable to include it.