Stop resource access token generation by default

What does this MR do and why?

• Previously, every call to /api/v4/projects/:id/product_analytics/proxy/load generates a new resource access token, even if it wasn't neccessary for that particular call.
• This MR changes the logic so that a token is never generated, unless specifically requested with the include_token parameter.
• Adds API documentation.
• Adds required specs.

⚠ This is a change to an alpha, default-off API with no known end-users.

Screenshots or screen recordings

Screenshots are required for UI changes, and strongly recommended for all other merge requests.

How to set up and validate locally

Numbered steps to set up and validate the change are strongly suggested.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

• I have evaluated the MR acceptance checklist for this MR.

Related to #389281