Move HF_TOKEN to libgit2 lib

[rasapala]

🛠 Summary

JIRA CVS-194439, CVS-194440
Remove debug logs and move token setting to libgit2 library.

🧪 Checklist

• Unit tests added.
• The documentation updated.
• Change follows security best practices.
  ``

[Copilot]

🟡 Changes recommended

A new/updated logging path still prints default environment values despite the stated intent to avoid logging env values, which is a security-hardening inconsistency.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR adjusts Hugging Face model pulling to avoid embedding HF_TOKEN in repository URLs, instead relying on libgit2/LFS integration to apply authentication, and removes overly-verbose debug logging of environment variable values.

Changes:

• Removed hfToken plumbed through HfDownloader and stopped constructing credential-in-URL repo strings.
• Added HF_TOKEN-based auth configuration in the libgit2 LFS curl path (via the vendored lfs.patch).
• Reduced debug logging to avoid printing environment variable values.

File summaries

File	Description
third_party/libgit2/lfs.patch	Adds curl auth configuration for LFS requests based on HF_TOKEN.
src/test/pull_hf_model_test.cpp	Updates unit tests to reflect token no longer being embedded in repo URLs.
src/pull_module/libgit2.hpp	Updates HfDownloader API by removing the hfToken constructor parameter/member.
src/pull_module/libgit2.cpp	Removes URL-embedded-credentials logic and clones using the plain repo URL.
src/pull_module/hf_pull_model_module.cpp	Avoids logging environment variable values and updates HfDownloader construction accordingly.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.