Better control who can generate Personal Access Tokens

Expected Results
Provide a way to control who can generate tokens. For example allow specific set of users/groups to do it.

Actual Results
Either all users can generate a tokens or none of them (if the feature is disabled).