fetch-github-token: consider emitting ::add-mask:: for fetched tokens

## Context

Downstream workflows (e.g. changelog submit in `docs-actions`) obtain short-lived GitHub tokens via `elastic/ci-gh-actions/fetch-github-token@v1` and pass them into composite actions or steps as outputs. Those values are not in `secrets.*`, so they may not get the same automatic log masking as repository/organization secrets.

We discussed whether a separate workflow step that does `echo "::add-mask::$TOKEN"` is desirable—it still prints the token once to register masking—and agreed that having **the token-fetch action** handle masking at the source would be cleaner when masking is appropriate.

## Question

Does it make sense for **`fetch-github-token`** (or the shared implementation it uses) to **emit `::add-mask::` for the produced GitHub token** (or document a deliberate decision not to), so consumers do not need ad-hoc masking steps and token values are less likely to appear verbatim in job logs?

## Possible considerations

- GitHub Actions behavior: `add-mask` registers values for redaction in subsequent log output; any tradeoffs for the line that registers the mask.
- Whether all call sites want masking (e.g. debugging) or if masking should be optional/configurable.
- Interaction with Vault/OIDC flows and whether masking belongs in this action vs. a lower-level helper.

## Reference

- Action path: `fetch-github-token/` in this repo.
- Related consumer discussion: passing `org-check-token` from `fetch-github-token` into `docs-actions/changelog/submit` without duplicating masking in the caller workflow.

---

cc @elastic/ci-gh-actions maintainers — happy to narrow scope or split into a docs-only issue if that fits better.

Start by reading the fetch-github-token/ action path and trace the shared implementation it uses, then review how its output is passed to docs-actions/changelog/submit. Check the GitHub Actions ::add-mask:: behavior and the Vault/OIDC call sites mentioned in the issue. Done means either implementing an appropriate masking decision for consumers or documenting why masking should remain optional or caller-controlled.

Written by the indexing model from the issue text.