Installer script doesn't work for private repos

Hi, I've recently had to make a repository using cargo-dist private, and now I made a private release and the installer script doesn't work.

I get `curl: (22) The requested URL returned error: 404`

The script runs

```
curl -sSfL --header "Authorization: Bearer ${AUTH_TOKEN}" "$1" -o "$2"
```

Which for my case translates to e.g.:

```
AUTH_TOKEN="${PLOTINATOR3000_GITHUB_TOKEN:-}"
curl -sSfL --header "Authorization: Bearer ${AUTH_TOKEN}" https://github.com/luftkode/plotinator3000/releases/download/v3.0.0/plotinator3000-x86_64-unknown-linux-gnu.tar.xz -o /tmp/tmp.E7qtEN16Q7/input.tar.xz
```

But that simply doesn't work. Using a classic token with all permissions to run the same command in the terminal, also doesn't work, because GitHub is much more strict about accessing private repositories, you're forced to go through the API and not just the link that would work in the browser.

I've been down this rabbit hole before with using installer scripts, and by far the simplest solution is to use the github CLI, but that obviously doesn't generalize super well (forcing users to have the gh CLI installed).

It's possible with curl, but it requires a much more sophisticated approach.

Start by locating the generated installer script and the curl download entry point described in the report. Reproduce the private-release download failure, then inspect how authenticated release assets are fetched; done means the installer can download private assets with the documented token setup without requiring gh.

Written by the indexing model from the issue text.