Make GitHub token use consistent within nbdev

There are currently several ways to store and use GitHub tokens within nbdev:
1. The [release docs](https://nbdev.fast.ai/api/release.html#setup) specify creating a `token` file in the root of your repo.
2. Both [config/_get_info](https://github.com/fastai/nbdev/blob/master/nbdev/config.py#L84) and [cli/_update_repo_meta](https://github.com/fastai/nbdev/blob/master/nbdev/cli.py#L69) use the environment variable `GITHUB_TOKEN`.
3. [nbdev_release](https://github.com/fastai/nbdev/blob/master/nbdev/release.py#L54) looks for the token in 3 places. In order of preference:
a. the environment variable `NBDEV_TOKEN`
b. a `token` file in the root of your repo
c. the environment variable `GITHUB_TOKEN`

This confused me earlier today, when the token in my 'token' file expired, and setting the GITHUB_TOKEN environment variable had no effect.

It would be beneficial to:

1. decide on a single order of preference for where the token is obtained, use it consistently across all of nbdev, and describe it in the docs.
2. if a method that looks for a token has a debug flag that is true, print out where the token was obtained from.