Changes

fix(pipelines): stop exposing github token to PR jobs (#4460)

## Summary
- remove global `GITHUB_TOKEN = credentials('github-bot-token')`
injection from `pull_*` pipelines that execute untrusted PR code
- keep non-sensitive `environment` entries such as `OCI_ARTIFACT_HOST`
unchanged
- limit the scope to PR-triggered pipelines; merged pipelines are not
changed in this patch

## Risk
These PR jobs were exposing a GitHub bot token to the full Jenkins
execution environment even though the variable was not consumed later in
the pipeline. A malicious PR could potentially read the token from the
process environment.

## Verification
- `git diff --check`
- verified no `pull_*.groovy` file still contains `GITHUB_TOKEN =
credentials(...)` or `GH_TOKEN = credentials(...)`
- verified no empty `environment {}` blocks remain after the cleanup
 (commit: 1b271fa)