zero update: 403 on shared IPs (GitHub API calls are unauthenticated)

[Vasanthdev2004]

zero update calls the GitHub releases API unauthenticated, so on a shared egress IP — Termux/PRoot, CI runners, some corporate NATs — it hits GitHub's 60 req/hr unauthenticated limit and the update check fails with 403 Forbidden.

Fix: attach Authorization: Bearer <token> when a token is available, read from ZERO_GITHUB_TOKEN (preferred) or GITHUB_TOKEN. The token must only go to https://api.github.com — never a custom --endpoint / ZERO_UPDATE_RELEASE_URL host, and never over plaintext HTTP — so a copied or mistyped endpoint can't leak the credential.

Being fixed in #504.

[Vasanthdev2004]

Tracked by #504, which authenticates the release check and is the fix for this. That PR has changes requested on it at the moment, so this stays open until it lands.