CI: New Rolling release upload token for Cirrus

Add a new token that can upload Rolling release binaries from Cirrus
to GitHub Releases for the Rolling repo.

Prefer this token in the upload script if it is set in the
corresponding env var ROLLING_UPLOAD_TOKEN, otherwise try GITHUB_TOKEN
(This allows the script to work in Cirrus, where the new env var will
be set, and in GitHub Actions where we use the GITHUB_TOKEN.)

(Testing to see if this can be set per-script, otherwise we will have
to set it for the whole task instead.)

.cirrus.yml

@@ -99,6 +99,8 @@ arm_linux_task:
     - export BINARY_NAME='squashfs-root/pulsar'
     - Xvfb :99 & DISPLAY=:99 PLAYWRIGHT_JUNIT_OUTPUT_NAME=report.xml npx playwright test --reporter=junit,list
   rolling_upload_script:
+    env:
+      ROLLING_UPLOAD_TOKEN: ENCRYPTED[690950798401ec3715e9d20ac29a0859d3c58097038081ff6afeaf4721e661672d34eb952d8a6442bc7410821ab8545a]
     - cd ./script/rolling-release-scripts
     - npm install
     - node ./rolling-release-binary-upload.js cirrus
@@ -147,6 +149,8 @@ silicon_mac_task:
     - export BINARY_NAME=`ls /Volumes/Pulsar*/Pulsar.app/Contents/MacOS/Pulsar`
     - PLAYWRIGHT_JUNIT_OUTPUT_NAME=report.xml npx playwright test --reporter=junit,list
   rolling_upload_script:
+    env:
+      ROLLING_UPLOAD_TOKEN: ENCRYPTED[690950798401ec3715e9d20ac29a0859d3c58097038081ff6afeaf4721e661672d34eb952d8a6442bc7410821ab8545a]
     - export PATH="/opt/homebrew/bin:/opt/homebrew/opt/node@16/bin:$PATH"
     - cd ./script/rolling-release-scripts
     - npm install

script/rolling-release-scripts/rolling-release-binary-upload.js

@@ -49,7 +49,7 @@ if (cirrusFlag === "cirrus") {
   console.log(`Uploading local binaries to rolling release repo: ${binaryAssets.join(",")}`);
 
   publish({
-    token: process.env.GITHUB_TOKEN,
+    token: process.env.ROLLING_UPLOAD_TOKEN || process.env.GITHUB_TOKEN,
     owner: "pulsar-edit",
     repo: "pulsar-rolling-releases",
     name: packageJson.version,