setup-avocado-cli: authenticate the release lookup and retry transients

[mobileoverlord]

What

setup-avocado-cli resolves latest by calling api.github.com with no credentials:

ver="$(curl -sSfL "https://api.github.com/repos/${repo}/releases/latest" | jq -r .tag_name)"

Unauthenticated GitHub API is capped at 60 requests/hour per IP. avocado-linux/references runs ~35 jobs concurrently, so jobs lose that race and die in the "Install avocado CLI" step before doing any work:

curl: (22) The requested URL returned error: 403

Hit this on references#23: the dev reference failed this way while the other 34 jobs passed, having passed in the two preceding runs. It reads as a flaky reference, but nothing about the reference is involved — and with a matrix that size it will keep recurring.

Fix

• Send github.token on the API request, raising the limit to 1000/hour for the repo. Callers need no change — the token comes from the composite action's own github context. The header is only added when the token is non-empty, so a pinned version: still works with no token at all.
• --retry 3 --retry-all-errors on both the API call and the asset download, for the transient 5xx/connection blips auth does not fix.
• Fail with a clear message when the tag cannot be resolved, instead of building a download URL containing a literal null.

Verification

action.yml parses; the embedded script passes bash -n. Checked the empty-array expansion under set -euo pipefail in both branches (token present and absent) — used the explicit if form rather than [ ... ] && ... so it does not depend on set -e's subtler AND-list semantics.

Note

main and the v1 tag currently have identical content for this file, and every consumer pins @v1, so v1 needs re-pointing after merge for this to take effect.