Authenticate the GitHub API call to avoid rate limiting

[Amoifr]

Fixes #60

TailwindVersionFinder queries the GitHub API to resolve the latest Tailwind release, but the request is anonymous, so it hits the low unauthenticated rate limit (60 requests/hour, shared per IP). That is what bit @nicolas-grekas during a workshop where everyone shared the same IP. The test suite already works around this by reading GITHUB_TOKEN, but the runtime code did not.

This authenticates the call with auth_bearer whenever a GitHub token can be found, looked up in this order:

1. the GITHUB_TOKEN / GH_TOKEN environment variables (same convention as the existing test);
2. the COMPOSER_AUTH environment variable;
3. Composer's global auth.json (COMPOSER_HOME/auth.json, otherwise ~/.composer/auth.json and ~/.config/composer/auth.json), reading the github-oauth token developers usually already have configured (@nicolas-grekas' first idea).

Without any token the behavior is unchanged (still anonymous, just rate limited as before), so nothing breaks for existing setups.

Tests use a MockHttpClient to assert the Authorization header is sent for each source and absent otherwise, with the environment isolated so the existing live test keeps reading GITHUB_TOKEN.

A couple of deliberate scope choices, happy to adjust:

• I only read Composer's global auth.json, not a project-level one, since the github-oauth token is almost always global. Easy to add if you'd prefer.
• I did not implement the "commit the resolved version" idea from the issue; that felt like a separate feature.

Thanks a lot for the bundle, and @bocharsky-bw for keeping this one alive! 🙏

[kbond]

Thanks @Amoifr, great addition! I made a few minor modifications.