Replace the `VAGRANT_ALLOW_PARAM_AUTH_TOKEN` environment variable
with `VAGRANT_SERVER_ACCESS_TOKEN_BY_URL` and update the behavior
when the environment variable is set to add the access token as
a query parameter and disable the addition of the authentication
header.
Fixes#12080
This sets the `authenticate_box_url` hook as deprecated and also
disables the cloud auth middleware from adding an access token
as a URL parameter by default. An environment variable has been
added which can be used for re-enabling the access token URL
parameter behavior if required for some legacy system which does
not support the authorization header.
