Closes #15754: Remove staff_only=True from admin menu items

[jeremystretch]

Fixes: #15754

• Remove staff_only=True from all menu items
• Add a warning to the API token edit view for non-superusers

There's an odd issue here where regular users will see the API token items under the admin menu, because by default all users have permission to create their own tokens. We also can't hide the menu item from non-superusers entirely, because it's valid to assign a non-superuser permissions to create tokens for specific other accounts (e.g. service accounts), which can only be done via the admin views. So, I've settled on displaying a warning for non-superusers directing them to create tokens using the relevant account views.

(Note that there's no security issue here: Attempting to create/modify a token for another user will fail just as it will in the current release. I just want to mitigate the inevitable confusion of having two paths to create a token.)