Eliminate the need for GITHUB_TOKEN in the environment

[jason-c-daniels]

Problem
Storing a GitHub token in the environment is somewhat risky, no matter how short lived.

Possible resolution
Perhaps provide a flag that indicates if gh auth login or gh auth login --with-token < some-token-file.txt can be used to help people better secure their GitHub secrets.

Workaround considered:
A secrets manager wrapper that only sets the environment for the course of that run.
I've not found any (yet) that run in git-bash. Even with this workaround, there's a chance that the process could get compromised exposing the secret. Albeit the window of opportunity is much lower.