Collapse GITHUB_TOKEN and GHCR_CREDS down to a single variable.

[partkyle]

          We would need only one of them. We can take care of this later.

Originally posted by @naveensrinivasan in #168 (comment)

[marshall007]

It turns out we need neither of them! I created #256 which:

1. removes the dependency on the GH API for fetching package versions
2. fetches tags directly from the registry and uses hashicorp/go-version to sort them semantically
3. uses github.com/google/go-containerregistry/pkg/authn to source registry credentials from standard locations instead of a custom --registry-creds CLI argument