Update WinGet publish script to use env var instead of --token

[mdanish-kh]

With the latest winget-create release, the preferred method for providing the GitHub token in CI/CD environment is via the environment variable WINGET_CREATE_GITHUB_TOKEN. Removed use of --token and switched to environment variable. See https://aka.ms/winget-create-token for details.

[DHowett]

after reviewing three of these, I am somewhat suspect that all callers need to always be updated to the latest whiz-bang thing immediately. But also, I don't mind

[mdanish-kh]

after reviewing three of these, I am somewhat suspect that all callers need to always be updated to the latest whiz-bang thing immediately. But also, I don't mind

Not immediately as --token isn't being fully removed per se (the team was aware of the blast radius that would've caused), but being asked as a security consideration. One may also just opt to use a versioned URL of winget-create in their CIs.