fix: pass the GitHub token as a build secret, resolve static-php-cli tag without GitHub API

[stasadev]

The Issue

• Related to Adding this add-on causes failures on ddev restart ddev/ddev-nvm#6
• Follow-up to fix: pass the GitHub token to PIE through COMPOSER_AUTH ddev/ddev-sqlsrv#57

The latest static-php-cli tag came from api.github.com, which allows 60 unauthenticated requests per hour per IP. The token was passed as a build arg, which is recorded in docker history and in .ddev/.ddev-docker-compose-full.yaml.

How This PR Solves The Issue

• Read the tag from the https://github.com/crazywhalecc/static-php-cli/releases/latest redirect, which is not API rate-limited, and check that it looks like a version
• Remove the GITHUB_TOKEN build arg and mount the github_token build secret that DDEV provides since feat: pass GitHub token to web builds as a secret, document PIE, fixes #7929, fixes #8549 (#8948) [skip ci] ddev/ddev#8948
• Export the secret as GITHUB_TOKEN for bin/spc download. composer update doesn't need it, because Composer downloads from GitHub don't count against the API rate limit

Manual Testing Instructions

ddev utility download-ddev --pr 8948
export PATH="$HOME/tmp/ddev-download-ddev/pr-8948:$PATH"
ddev config --project-type=php
ddev dotenv set .ddev/.env.php-patch-build --static-php-version=8.3.19
ddev add-on get https://github.com/rfay/ddev-php-patch-build/tarball/refs/pull/14/head
ddev restart
ddev php -v
# A bogus token must reach static-php-cli and fail the build:
DDEV_GITHUB_TOKEN=ghp_bogus ddev utility rebuild
# Expect "using bearer github token" followed by "curl: (22) The requested URL returned error: 401"

Automated Testing Overview

No new tests. The HEAD job passes the action's token through the secret. The stable job builds without a token until ddev/ddev#8948 is in a DDEV release.

Release/Deployment Notes

With DDEV v1.25.4 and older, the token is no longer passed to the build.

[rfay]

Thanks!