Supply the Google Play AAS token without writing it to disk (env var / --token-file / stdin)

Right now the only non-argv way to give apkeep the Google Play `aas_token` (or the `auth_token` added in 1.0.0) is the ini file passed with `-i`, which means the token has to be written to disk in cleartext.

I fetch the token from a secrets manager at runtime and would rather never persist it. Could apkeep gain a way to read the token from one of:

- an environment variable, e.g. `APKEEP_AAS_TOKEN` / `APKEEP_AUTH_TOKEN`;
- a `--token-file` pointing at a path the caller controls (so it can be a pipe / process substitution / `/dev/fd/...` rather than a real file on disk); or
- stdin.

The `-i` ini file can stay exactly as-is for the common case — this would just add a path for callers who already hold the token in memory and want to keep it off both the argv (already avoided via the ini) and the disk.

Tested against 1.0.0. Thanks for apkeep.

Start by tracing the existing -i ini-file and non-argv token handling, then inspect the command-line argument definitions and current tests. Clarify precedence and error behavior for environment variables, --token-file, and stdin before implementing the chosen inputs. Done means a caller can supply the token without persisting it, while the existing ini-file path remains unchanged and the new paths are covered by tests.

Written by the indexing model from the issue text.