Don't store authentication credentials in $XDG_CONFIG_HOME

After running `exercism configure --token=''` I find that my token is stored in `$XDG_CONFIG_HOME/exercism/user.json`.

This is a security risk because users who do not expect authentication data to be stored here may accidentally back it up insecurely. Configuration fields like `apibaseurl` and `workspace` are fine, but prefer storing `token` somewhere in `$XDG_DATA_HOME` to conform to the standard.

Reference: https://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html

```
$XDG_CONFIG_HOME defines the base directory relative to which user specific
configuration files should be stored. If $XDG_CONFIG_HOME is either not set or
empty, a default equal to $HOME/.config should be used.
```

```
$XDG_DATA_HOME defines the base directory relative to which user specific data
files should be stored. If $XDG_DATA_HOME is either not set or empty, a default
equal to $HOME/.local/share should be used.
```