[6.x] Work around new GitHub token format breaking CI

[jasonvarga]

GitHub started rolling out a new installation token format on 2026-04-27 (see changelog). The new ghs_APPID_JWT token contains base64url characters, including -. Composer 2.9.7's token validation regex (^[.A-Za-z0-9_]+$ in BaseIO.php) does not allow -, so the auto-set GITHUB_TOKEN now sporadically fails the composer require step with:

Your github oauth token for github.com contains invalid characters: "***"

Upstream issue: composer/composer#12849.

Passing an empty github-token to shivammathur/setup-php stops it from writing GITHUB_TOKEN into Composer's auth config, so Composer never sees the new-format token. Composer will fall back to unauthenticated GitHub API calls during dependency resolution, which is fine for our public-only dependency graph.

Once Composer ships a patched release, we can revert this.

[duncanmcclean]

Looks like Composer have just fixed this: https://blog.packagist.com/composer-2-9-8-and-2-2-28-fix-github-actions-token-disclosure-in-error-messages/