Remove access token from asset url when unnecessary

[licitdev]

Closes #10469.

Static access token is automatically appended when an asset is selected.
For the assets to be visible in WYSIWYG, permissions have to be set for the public role or an access token to be provided.

#10054 introduced width and height into the URL params, resulting in the order of access_token changing positions. The different URLs led to two image requests sent, leading to a race condition in image transformation, where the latter request completes with 0 byte file first. The invalid 0 byte file may also be cached by the browser.

Todo

• Similar refactor of access_token for media upload
• Rename Image Token to Static Access Token
• Fix wysiwyg dirty check

[rijkvanzanten]

Lets leave the name imageToken for now, and use it for all image assets. We can rename the label in the options to make more sense. I'd prefer using the old key name in the options over another migration to mess with the options object 👍🏻