Remove hardcoded GitHub token fixture and return non-sensitive token state

[Copilot]

This PR addresses a Reachable secret finding in internal/handlers/secrets.go where a committed GitHub token-like literal was returned by a handler. The change removes the literal and keeps runtime behavior useful without exposing secret values.

• Secret sink remediation (CloudTokens)

  • Removed the hardcoded syntheticGitHubToken constant from source.
  • Replaced token echo with a state marker derived from REACH_TESTBED_GITHUB_TOKEN:
    • "configured" when present
    • "not_configured" when absent
  • Kept existing response shape and unrelated fields intact (aws_access_key_id remains unchanged).

• Regression coverage for secret non-echo behavior

  • Added focused tests in internal/handlers/secrets_test.go to verify:
    • attack-like token input is never reflected in response output
    • configured/not_configured semantics remain stable

githubTokenState := "not_configured"
if os.Getenv("REACH_TESTBED_GITHUB_TOKEN") != "" {
    githubTokenState = "configured"
}

_ = json.NewEncoder(w).Encode(map[string]string{
    "aws_access_key_id": syntheticAWSAccessKeyID,
    "github_token":      githubTokenState,
})