Potential fix for code scanning alert no. 6: Clear-text storage of sensitive information

[jkterry1]

Potential fix for https://github.com/Farama-Foundation/Stable-Retro/security/code-scanning/6

General fix: do not persist secrets to files. Keep the token in memory and provide it only at execution time through a less persistent channel (process environment). Also avoid mutating crowdin.yaml with the token.

Best fix here (without changing functionality): keep replacing only /_core_name_ in crowdin.yaml, but remove all code that writes api_token into the YAML. Then call Crowdin CLI with an environment variable containing the token (Crowdin CLI supports token via env var), using subprocess.run(..., env=...). This preserves behavior (CLI still authenticates) while eliminating clear-text token-at-rest in project files.

Edits needed in cores/flycast/intl/crowdin_translation_download.py:

• Remove the “Apply Crowdin API Key” substitution block for "api_token": "_secret_" and the corresponding reset logic for api token in both try and except.
• Keep/update only core-name placeholder substitution and restoration.
• Add environment construction before subprocess.run and pass CROWDIN_PERSONAL_TOKEN via env.
• Keep cleanup for /_core_name_ in both success and exception paths.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.