vocabulary entries returned do not include their token

[jackahl]

When a vocabulary is used by a querystring param only value and title are returned. This also exposes the values via the REST api which can become problematic, as values are not necessarily string values, but can potentially even be python objects.

Therefore we should aim to rather use the token instead of value when used in Volto via REST api. To prepare for that change, the token should be included in the api response. In a later stage we should refactor it so, that the api response does not include the value at all. But that should be done in plone.restapi and volto respectively.