Description
We should alter the update the CreateOnBehalfOfTokenAction which is a RestHandler to use NamedRoutes, which will enforce permissions before the API can be used, permission named to be determined, placeholder, security:user.createOnBehalfOfToken.

Current Design VS Goal
According to the current design (source code), users do not need any permission to access the OBO token creation endpoint: _plugin/_securitty/api/user/onbehalfof. The goal of this issue is to register a specific security permission for accessing this endpoint.