fix: Support private repositories

[Mrtenz]

Summary

• Replace curl with gh api when downloading .nvmrc and yarn.lock from GitHub, so that downloads work for private repositories as well.
• Add GH_TOKEN: ${{ github.token }} to the relevant steps to authenticate the gh CLI.

---

Note

Low Risk
Scoped to how two files are downloaded during CI setup; uses the standard workflow token and does not change install or caching logic.

Overview
Fixes composite action setup when the repo is private by fetching .nvmrc and yarn.lock through the GitHub Contents API with gh api instead of unauthenticated raw.githubusercontent.com URLs.

Both the compute-node-version and download-yarn-lock steps now set GH_TOKEN: ${{ github.token }} so gh can read repo contents at the requested ref. Failure/warning messages were updated to reference owner/repo@ref instead of the old raw URL.

^{Reviewed by Cursor Bugbot for commit c3d0059. Bugbot is set up for automated code reviews on this repo. Configure here.}

[HowardBraham]

@Mrtenz have you benchmarked how this affects speed?

[Mrtenz]

@Mrtenz have you benchmarked how this affects speed?

@HowardBraham I did a couple runs in a private repo with this branch and in a public repo with v3 and did not see any noticeable difference.

[HowardBraham]

@Mrtenz can you run some tests in metamask-extension please and show me? That repo is a beast and really needs all the optimizations we can do.

[Mrtenz]

@Mrtenz can you run some tests in metamask-extension please and show me? That repo is a beast and really needs all the optimizations we can do.

@HowardBraham The couple runs I did here seem to be within margin of error (some quicker, some slower) compared to other PRs: https://github.com/MetaMask/metamask-extension/actions/runs/27162320788/job/80183586844?pr=43342

[HowardBraham]

The timings and functionality look good