Remediate hardcoded GitHub PAT in internal/handlers/secrets.go via runtime secret loading

[Copilot]

This PR addresses the Reachable secret finding for a GitHub Personal Access Token pattern committed in production handler code. The remediation removes the embedded token value and shifts token sourcing to runtime configuration.

• Scope (selected remediation unit)

  • RCH-RULE-b4ff9103 in internal/handlers/secrets.go
  • Limited change to the selected file only.

• Secret handling change

  • Removed the hardcoded ghp_...-shaped constant from source.
  • Updated CloudTokens to read github_token from REACH_TESTBED_GITHUB_TOKEN.

• Fallback behavior

  • When the env var is unset, the handler now emits a neutral non-secret placeholder (NOT_CONFIGURED) rather than a token-shaped literal.

func CloudTokens(w http.ResponseWriter, _ *http.Request) {
    githubToken := os.Getenv("REACH_TESTBED_GITHUB_TOKEN")
    if githubToken == "" {
        githubToken = "NOT_CONFIGURED"
    }

    _ = json.NewEncoder(w).Encode(map[string]string{
        "aws_access_key_id": syntheticAWSAccessKeyID,
        "github_token":      githubToken,
    })
}