fix: INF-667 fetch GitHub release assets via api.github.com (avoids web-tier 504s)

[fago]

Problem

PharInstaller::download() fetched release binaries (e.g. local-php-security-checker) with a bare file_get_contents() against the github.com web tier. That tier intermittently returns edge 504s for some CI egress IPs and applies stricter unauthenticated limits — which broke composer install / Docker builds on ci2 (see INF-667).

Fix

Route https://github.com/<o>/<r>/releases/download/... URLs through the api.github.com release-asset endpoint instead — a different, healthy host whose *.githubusercontent.com asset CDN is independent of the failing web tier.

• Resolves the release by tag via api.github.com, then downloads the matching asset.
• Token-optional: uses the github-oauth token Composer already holds when present (relaxes the anonymous rate limit), but works fully unauthenticated too — important for builds that have no token configured.
• The binary download itself carries no Authorization header (the API 302-redirects to a pre-signed CDN URL that rejects an extra auth header; these tools live in public repos).
• Falls back to the original github.com URL on any failure, with a small retry/backoff — so behaviour is never worse than before.

Ref: INF-667. Mirrors drunomics/ldp-project#2731.

🤖 Generated with Claude Code