Currently, some token types besides those documented in [the Token
authentication section of the GraphQL docs][1] can be used to
authenticate a user for GraphQL. This MR ensures that only the
documented token types are usable, once the associated feature flag is
enabled.

[1]: https://docs.gitlab.com/ee/api/graphql/#token-authentication

Changelog: fixed