deprecate authJWTInHTTPQuery and disable JWTs in query parameters (#5648)

This fixes a long standing security flaw. Even though it's a breaking
change, few users should be impacted since this feature has been discouraged
for some time.

api/openapi.yaml

@@ -270,6 +270,10 @@ components:
           type: string
         authJWTClaimKey:
           type: string
+        authJWTInHTTPQuery:
+          type: boolean
+          nullable: true
+          deprecated: true
         authJWTIssuer:
           type: string
         authJWTAudience:
@@ -278,8 +282,6 @@ components:
           type: array
           items:
             $ref: '#/components/schemas/AuthInternalUserPermission'
-        authJWTInHTTPQuery:
-          type: boolean
 
         # Control API
         api: