Make ALLOW_TOKEN_RETRIEVAL = False the default

[hikhvar]

NetBox version

v4.2.3

Feature type

Change to existing functionality

Proposed functionality

Currently,
a newly setup netbox will have set ALLOW_TOKEN_RETRIEVAL = True. This is a bad and insecure default, as API tokens of users should not be visible to administrators.

Use case

Be more secure by default.

If somebody gets administrator permissions on accident (people make errors), they immediatly have access to all tokens with the current default. That should not be the case

Database changes

No response

External dependencies

No response

[jeremystretch]

This needs to be picked up in a minor release as changing the default behavior is considered a breaking change.

[hikhvar]

Can we pick it for netbox v4.3 as that is the next minor release? I would happily take the topic and implement it.