Add GitHub-backed intake authentication

[isPANN]

Summary

• authenticate submitters with an application-scoped Cloudflare Access token instead of a shared intake key
• verify Cf-Access-Jwt-Assertion signature, issuer, audience, expiry, token type, subject, and email in the Worker
• record authenticated Access identity separately from the submitter-claimed JSON identity
• retain PRB_API_KEY only as a no-assertion migration fallback, with no downgrade after failed Access verification
• test and bundle the Worker in CI

Client safety

• PRB_ACCESS_TOKEN is preferred over an ambient legacy key and the client never sends both
• successful non-JSON responses (such as an Access login page) are no longer reported as accepted submissions
• documentation keeps token retrieval inside command substitution because standalone cloudflared login/token commands may print the JWT
• GitHub PATs, gh auth token, and GITHUB_TOKEN are not accepted as intake credentials

Verification

• npm test: 5 Worker authentication tests passed
• npm run check: Wrangler dry-run bundle passed
• uv run pytest -q: 222 passed, 4 skipped
• Access-protected preview uploaded at https://access-auth-intake.prb-bench.workers.dev
• authenticated no-write probe reached Worker validation and returned the expected HTTP 400 shape error
• private fake --test upload accepted as submission c11a6280-12c4-4517-b86b-1c48ab3c0509

This PR does not deploy the version to production traffic or remove the legacy secret.