Potential fix for code scanning alert no. 7: Clear-text storage of sensitive information

[jkterry1]

Potential fix for https://github.com/Farama-Foundation/Stable-Retro/security/code-scanning/7

Best fix: avoid storing the API token in crowdin.yaml entirely. Instead, keep crowdin.yaml token placeholder unchanged and pass the token securely at runtime via an environment variable to subprocess.run. Crowdin CLI supports CROWDIN_PERSONAL_TOKEN, so we can inject it into the subprocess environment (env=...) and remove all token write/reset logic. This preserves functionality (CLI still authenticates) while eliminating clear-text persistence.

In cores/flycast/intl/initial_sync.py:

• Keep core name substitution in YAML (/_core_name_ replacement), since that is not secret.
• Remove the API token substitution block that writes secret into YAML.
• Build crowdin_env = os.environ.copy(); crowdin_env['CROWDIN_PERSONAL_TOKEN'] = API_KEY.
• Pass env=crowdin_env to both CLI subprocess.run calls.
• In exception cleanup, remove API token reset substitution and only revert core name placeholder.
• Optionally clear in-memory reference after use (API_KEY = None) to reduce lingering secret lifetime.

No new imports or dependencies required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.