JetBrains Runtime release requests ignore the token input #1221

Description:
actions/setup-java@v6 and current main define the token input with ${{ github.token }} as its GitHub.com default, but the JetBrains Runtime installer reads only process.env.GITHUB_TOKEN when it paginates the GitHub Releases API. GitHub Actions does not automatically export github.token as that environment variable, so normal JetBrains Runtime setup requests are unauthenticated despite the action receiving its default token input.

This reduces the GitHub REST API limit from the authenticated allowance to the shared unauthenticated limit (typically 60 requests/hour per source IP). JetBrains release discovery can make multiple paginated requests, making rate-limit failures more likely. Existing end-to-end workflows that explicitly export GITHUB_TOKEN mask the default-input path.

The JetBrains installer should use the action token input first, retain GITHUB_TOKEN as a backward-compatible fallback, send no authorization header when both are empty, and preserve authentication across pagination. Its Releases API requests should use an appropriate JSON GitHub API Accept header rather than a Contents API raw-media header. The token must never be logged.

Task version:
actions/setup-java@v6 and current main

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Repro steps:

1. Run actions/setup-java@v6 with distribution: jetbrains and a Java version, without setting an env.GITHUB_TOKEN value and without overriding the action's token input.
2. Observe the GitHub Releases API requests made while resolving JetBrains Runtime releases.
3. The action has received its default token: ${{ github.token }} input, but the JetBrains installer omits the Authorization header because it checks only process.env.GITHUB_TOKEN.
4. Repeated runs or pagination can exhaust the unauthenticated API quota and return rate-limit failures.

Expected behavior:
JetBrains Runtime release requests authenticate with the token action input by default. An explicitly supplied input takes precedence over GITHUB_TOKEN; the environment variable remains a fallback; pagination retains the same authentication; requests negotiate JSON; and no authorization header is sent when neither source is set.

Actual behavior:
JetBrains Runtime release requests use only process.env.GITHUB_TOKEN. Without an explicitly exported environment variable, requests are unauthenticated even though the action's token input contains ${{ github.token }}, causing unnecessary exposure to GitHub's unauthenticated rate limit.