fix(ci): wire GITHUB_TOKEN into docker image builds

tools/install/_common.sh calls api.github.com unauthenticated to
resolve each tool's latest-release asset URL. build-image.yaml and
build-image-test.yaml passed GITHUB_TOKEN via buildx `secrets:`,
but no Dockerfile RUN mounts that secret - dead config since #496,
never reconnected when #947 added ARG-based auth to the Dockerfile.

Result: every docker buildx build (PR test, nightly, release) hits
~10 unauthenticated GH API calls x up to 2 platforms. GitHub's
60/hr unauthenticated limit is shared across all Actions runners,
so any call landing on the limit gets no asset match -> curl gets
an empty URL -> exit 3. Observed here as tflint, but any GH-hosted
tool install can trip it.

Same class of bug as 65fe9e4 (reusable-tox.yml), different surface.

Assisted-by: Sisyphus:claude-sonnet-5 opencode

Author: MaxymVlasov

.github/workflows/build-image-test.yaml

@@ -68,13 +68,12 @@ jobs:
         context: .
         build-args: |
           INSTALL_ALL=true
+          GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
         push: false
         load: true
         tags: ${{ env.IMAGE }}
         # Fix multi-platform: https://github.com/docker/buildx/issues/1533
         provenance: false
-        secrets: |
-          "github_token=${{ secrets.GITHUB_TOKEN }}"
 
     - name: Setup Container Structure Tests
       if: steps.changed-files-specific.outputs.any_changed == 'true'
@@ -121,10 +120,9 @@ jobs:
         context: .
         build-args: |
           INSTALL_ALL=true
+          GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
         platforms: linux/amd64,linux/arm64
         push: false
         tags: ${{ env.IMAGE }}
         # Fix multi-platform: https://github.com/docker/buildx/issues/1533
         provenance: false
-        secrets: |
-          "github_token=${{ secrets.GITHUB_TOKEN }}"

.github/workflows/build-image.yaml

@@ -58,15 +58,14 @@ jobs:
         context: .
         build-args: |
           INSTALL_ALL=true
+          GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
         platforms: linux/amd64,linux/arm64
         push: true
         tags: |
           ${{ env.IMAGE_REPO }}:${{ env.IMAGE_TAG }}
           ${{ env.IMAGE_REPO }}:latest
         # Fix multi-platform: https://github.com/docker/buildx/issues/1533
         provenance: false
-        secrets: |
-          "github_token=${{ secrets.GITHUB_TOKEN }}"
 
     - name: Build and Push nightly
       if: github.event_name == 'schedule'
@@ -75,11 +74,10 @@ jobs:
         context: .
         build-args: |
           INSTALL_ALL=true
+          GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
         platforms: linux/amd64,linux/arm64
         push: true
         tags: |
           ${{ env.IMAGE_REPO }}:nightly
         # Fix multi-platform: https://github.com/docker/buildx/issues/1533
         provenance: false
-        secrets: |
-          "github_token=${{ secrets.GITHUB_TOKEN }}"