the implicit github-token passing

Well, that's what the actions/checkout does, but it might indeed not be a good idea here.

I will try to improve on cargo-binstall behavior, ideally users should not have to pass the github token, unless they are really installing a lot of crates or the crate itself doesn't provide any information in manifest and binstall has to figure out itself.

I think we can at least speed it up and avoid the need of token, for crate providing package.binstall with pkg-url

cc @taiki-e I have resolved the merge conflicts, can we merge this in and have another release please?