Deprecate "token" attribute from Runners API

It will be removed by 13.0

changelogs/unreleased/214320-deprecate-returning-token-from-runners-api.yml

+---
+title: Deprecate 'token' attribute from Runners API
+merge_request: 29481
+author:
+type: deprecated

doc/api/runners.md

@@ -162,6 +162,10 @@ GET /runners/:id
 curl --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/runners/6"
 ```
 
+CAUTION: **Deprecation**
+The `token` attribute in the response is deprecated [since GitLab 12.10](https://gitlab.com/gitlab-org/gitlab/-/issues/214320).
+It will be removed in [GitLab 13.0](https://gitlab.com/gitlab-org/gitlab/-/issues/214322).
+
 Example response:
 
 ```json
@@ -221,6 +225,10 @@ PUT /runners/:id
 curl --request PUT --header "PRIVATE-TOKEN: <your_access_token>" "https://gitlab.example.com/api/v4/runners/6" --form "description=test-1-20150125-test" --form "tag_list=ruby,mysql,tag1,tag2"
 ```
 
+CAUTION: **Deprecation**
+The `token` attribute in the response is deprecated [since GitLab 12.10](https://gitlab.com/gitlab-org/gitlab/-/issues/214320).
+It will be removed in [GitLab 13.0](https://gitlab.com/gitlab-org/gitlab/-/issues/214322).
+
 Example response:
 
 ```json

lib/api/entities/runner_details.rb

@@ -10,7 +10,11 @@ module API
       expose :access_level
       expose :version, :revision, :platform, :architecture
       expose :contacted_at
+
+      # @deprecated in 12.10 https://gitlab.com/gitlab-org/gitlab/-/issues/214320
+      # will be removed by 13.0 https://gitlab.com/gitlab-org/gitlab/-/issues/214322
       expose :token, if: lambda { |runner, options| options[:current_user].admin? || !runner.instance_type? }
+
       # rubocop: disable CodeReuse/ActiveRecord
       expose :projects, with: Entities::BasicProjectDetails do |runner, options|
         if options[:current_user].admin?