User Personal API Tokens instead of passwords

We are increasing support for Personal API Tokens (PAT) and I would like this change to be reflected in Boxen. The notion is that it is better to use one-off credentials for authenticating any applications because they provide better auditability and revokability. This PR should provide a clean migration from using passwords for API and git access to using PATs.

Calls to `config.password` will return the users token if is was already created. This means that users who have already authenticated wont notice anything. For users setting up Boxen for the first time, they will be prompted for a PAT that will be stored as their token. This code should also delete the stored password from the keychain.

/cc @wfarr @github/security