ensure_runners_token on read instead of write

1. we don't want to migrate all existing groups
2. we generate the token when showing the runners page, as this is the
   first time that the token will be used.

app/models/group.rb

@@ -47,7 +47,6 @@ class Group < Namespace
   validates :two_factor_grace_period, presence: true, numericality: { greater_than_or_equal_to: 0 }
 
   add_authentication_token_field :runners_token
-  before_save :ensure_runners_token
 
   after_create :post_create_hook
   after_destroy :post_destroy_hook
@@ -296,6 +295,13 @@ class Group < Namespace
     refresh_members_authorized_projects(blocking: false)
   end
 
+  # each existing group needs to have a `runners_token`.
+  # we do this on read since migrating all existing groups is not a feasible
+  # solution.
+  def runners_token
+    ensure_runners_token!
+  end
+
   private
 
   def update_two_factor_requirement