issue-73: reworking API key display logic and ways for sysadmin to access it

Solution to https://github.com/rspace-os/rspace-web/issues/73. This PR consists of multiple changes that should make retrieval of API key more secure and traceable.

The changes in behaviour:

for user who generated API key the value of their key is no longer sent to front-end whenever 'My Profile' page is displayed, but only after user explicitly clicks on 'Show Key' link
when System Admin user 'operates as' they can no longer see user's API key ('Show Key' returns an error); System Admin can still generate new API key or revoke the old one, as there may be valid reasons for these actions (similarly how we do allow System Admin to reset user's password)
the /apiKeyInfo/all endpoint within UserDetailsSysAdminApi is now only available when deployment property sysadmin.apikey.access is set to true (it's false by default)

rspace-os / rspace-web