Hide legacy form if application-level enforcement is enabled
- [x] Update `PersonalAccessTokensApp` so user can only create fine-grained token (`Preferences > Personal access tokens`) if enforcement is enabled. - [x] Return 404 for trying to access the legacy form if enforcement is enabled
issue