fix: remove GitHub VCS repo and make token optional

[jackwrfuller]

Description

Internal ticket: GOVCMS-14815

This PR removes the github vcs repository since it is redundant, and also makes the setting of the GOVCMS_GITHUB_TOKEN optional at build time.

This token is required because Packagist functions only as a metadata index and does not host packages directly. Composer frequently falls back to the GitHub HTTP API to resolve refs, fetch composer.json files, and download package distributions for non-Drupal dependencies (Symfony, Doctrine, Guzzle, etc.). Anonymous GitHub API access is limited to 60 requests per hour per IP, which is sufficient for local development but causes rate limit failures in shared environments (like GovCMS) where multiple builds share the same egress IP.

GovCMS sets this variable in production on project provisioning so customers do not have to perform this task. Locally however, there is no need for them to set this token.

[sonnykt]

reviewed and tested locally without any error for SaaS.

Local PaaS scaffold is failing however it's unrelated to the changes:

Your requirements could not be resolved to an installable set of packages.

  Problem 1
    - Root composer.json requires govcms/govcms 4.x-master-dev -> satisfiable by govcms/govcms[dev-4.x-master].
    - govcms/govcms dev-4.x-master requires simplesamlphp/simplesamlphp 2.5.2 -> satisfiable by simplesamlphp/simplesamlphp[v2.5.2].
    - simplesamlphp/composer-module-installer[v1.7.0, ..., v1.7.1] require composer-plugin-api ~2.9 -> found composer-plugin-api[2.6.0] but it does not match the constraint.
    - simplesamlphp/simplesamlphp[v2.5.2, ..., 2.5.x-dev] require simplesamlphp/composer-module-installer ~1.7 -> satisfiable by simplesamlphp/composer-module-installer[v1.7.0, v1.7.1].