Deprecate the token API query parameter

The API token should be included in a request using the `X-Consul-Token` header, but we still accept the token from a query parameter.

Query parameters can easily end up in logs, so generally it is considered a bad idea to accept authentication values via a query parameter.

We should deprecate support for the `token` API query parameter:

1. in the first release introduce a config option to disable support, default it to allow the query parameter, and add a warning when it's set to allow. The warning should indicate the default value will change in a future version.
2. in a following release change the default value to not allow
3. some time in the future remove support entirely

No files, tests, or entry points are named. Start by locating the Consul API handling for the token query parameter and the related configuration and warning paths; done means the staged deprecation behavior in the issue is represented, including the initial opt-out setting and warning.

Written by the indexing model from the issue text.