[SITE-5793] Fix script injection in Behat test workflow

[AnaisPantheor]

Summary

• Move ${{ secrets.GITHUB_TOKEN }} from run: block to env: block in test-behat.yml

Why

Using ${{ }} expressions directly inside run: blocks is a script injection vulnerability. Secrets interpolated into shell scripts can leak through error messages or shell tracing. The secure pattern is to pass them through env: blocks.

Test plan

• Verify Behat tests still authenticate with Composer and run successfully

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[jazzsequence]

Is this even needed? GHA environments naturally have a GH_TOKEN environment variable. This would only be needed if the token needs to be a PAT belonging to an actual individual/GH account.