Arvados

Make sure the token doesn't end up being copy-pasteable (see #11454 note-34, note-36)

Branch 13037-composer-link at 338fff463f52e222c41ada21dc2b7d27e878e2b5 works correctly but has the security implications that Tom mentions on the comment above.

13037-composer-link @ 6c99962c33249081e0a61aa9e843e09171784b26

Uses form with hidden input to obscure the api token.

Added styling for button to match other menu items in the dropdown menu.

LGTM