Use Bearer authentication to support fine-grained GitLab PATs

[balintbrews]

Send GitLab API tokens using Authorization: Bearer instead of PRIVATE-TOKEN to support fine-grained PATs. GitLab also supports Bearer authentication for classic PATs, so no separate mode is needed.

Token resolution is unchanged: DRUPALORG_GITLAB_TOKEN takes precedence over the existing glab fallback.

Testing

With both classic and fine-grained PATs:

• Read an issue, MR, pipeline status, and failed-job logs.
• Post unassign/reassign notes on an approved work item.
• Confirm the classic token also works through the glab fallback.

Verify note creation separately from bot-applied changes, which may be delayed.