mirror-token is sent to GitHub instead of token when mirror is set #1662

Description:
When both mirror and mirror-token are set, setup-node sends the mirror token to GitHub. It goes to two places in official_builds.ts:

1. The actions/node-versions manifest request through tc.getManifestFromRepo, in getManifest.
2. The binary download through tc.downloadTool, in setupNodeJs. This URL comes from the manifest's download_url, so it always points to github.com/actions/node-versions/releases/....

Both use this pattern:

this.nodeInfo.mirror && this.nodeInfo.mirrorToken
  ? this.nodeInfo.mirrorToken
  : this.nodeInfo.auth

This causes two problems:

• Security: A credential meant for a private mirror, such as an Artifactory token, gets sent to a third-party host. Mirror tokens should only go to the mirror.
• Rate limits: Because the mirror token replaces the GitHub token, manifest calls are made without the GitHub token. That makes them more likely to hit GitHub API rate limits. Only use mirrorToken in getManifest if it's provided #1548 fixed this only for the case where mirror-token is empty.

The calls that do go to the mirror already use mirrorToken correctly: getNodeJsVersions, downloadNodejs, and the Windows fallback in base-distribution.ts.

Related: #1412, #1467, #1548, #1661

Action version:
actions/setup-node@v7 (current main, 7.1.0). This happens in every version that sends mirror-token to the manifest request.

Platform:

• Ubuntu
• macOS
• Windows

Runner type:

• Hosted
• Self-hosted

Tools version:

Any Node.js version that is in the actions/node-versions manifest. This doesn't depend on the package manager.

Repro steps:

1. Use this step:

- uses: actions/setup-node@v7
  with:
    node-version: '24.9.0'
    mirror: 'https://my-mirror.example.com'
    mirror-token: ${{ secrets.MIRROR_TOKEN }}

2. Pick a node-version that is in the actions/node-versions manifest and not already in the runner's tool cache.
3. Watch the outgoing requests, for example with a proxy. The manifest request to the GitHub API and the binary download from github.com/actions/node-versions/releases/... both send Authorization: <MIRROR_TOKEN>.

Expected behavior:
Requests to GitHub always use token, sent as token <token> (this.nodeInfo.auth). mirror-token is only sent to URLs built from mirror.

Actual behavior:
mirror-token is sent to the GitHub API and to github.com release downloads instead of the GitHub token. This sends the mirror credential to GitHub, and the manifest call is made without the GitHub token.

Proposed fix:

• In official_builds.ts, pass this.nodeInfo.auth to both tc.getManifestFromRepo and the manifest-based tc.downloadTool call. Remove the mirror && mirrorToken ternary.
• Add tests to __tests__/official-installer.test.ts. No current test checks this case. The existing mirror-token tests only check log messages and that a download happened. With both mirror and mirror-token set, the new tests should check that:
  • getManifestFromRepo is called with 'token <token>', not the mirror token.
  • downloadTool gets 'token <token>' for the github.com/actions/node-versions/releases/... URL.
  • Requests to the mirror still use mirror-token.