Add environment variable authentication docs

[emcfarlane]

This improves the authentication docs for use of environment variable tokens. For enterprise runners, where the state between the runners is shared, this is an importent detail to avoid exposing the buf token to other actions.

[emcfarlane]

Still can use env variables but the majority of cases should be covered by #105 , so closing.