Improve user limit handling when fetching Knox Tokens

The current user limit behavior, which returns an error in case the user is trying to generate more tokens than he/she is allowed to, should be refined.

The plan is to introduce a new service-level parameter called knox.token.user.limit.exceeded.action. This new configuration may have the following values:

• REMOVE_OLDEST - if that’s configured, the oldest token of the user, who the token is being generated for, will be removed
• RETURN_ERROR - if that’s configured, Knox will return an error response with 403 error code (as it does today)

Defaults to RETURN_ERROR.