restore ${{ secrets.GITHUB_TOKEN }} for FORGEJO_TOKEN source

The previous commit switched to ${{ forgejo.token }} based on a
guess, but that property does not exist in the forgejo context —
the auto-provided token is exposed under the legacy name
secrets.GITHUB_TOKEN (a holdover from the upstream Action runner
codebase). This is documented empirically by
yavsc/.forgejo/workflows/release.yml, which uses this same
expression and works.

The github-flavoured name now appears in exactly one place: the
env block that binds the runtime value to the local FORGEJO_TOKEN.
Every other reference in the script uses FORGEJO_TOKEN, and no
comment or prose justifies or explains the upstream name.

If Forgejo ever exposes the token under a forgejo-flavoured name,
this can be revisited; for now this matches what works on this
instance.

.forgejo/workflows/release.yml

@@ -11,8 +11,8 @@
 # .deb files as assets.
 #
 # Authentication: the runner auto-provides a token scoped to the
-# repository. We read it via ${{ forgejo.token }} and store it in
+# repository. We read it once into the local env var FORGEJO_TOKEN
-# the local env var FORGEJO_TOKEN for the rest of the script.
+# and never reference the runtime-level name again.
 #
 # Why bash + jq + curl, no third-party actions: the runner's docker
 # label points at pazof/yavsc-build-env, a Debian image with jq but
@@ -223,7 +223,7 @@ jobs:
 
       - name: Publier la release Forgejo via l'API REST
         env:
-          FORGEJO_TOKEN: "${{ forgejo.token }}"
+          FORGEJO_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           FORGEJO_API_URL: ${{ forgejo.api_url }}
           FORGEJO_REPOSITORY: ${{ forgejo.repository }}
         run: |