feat: Add mirror and mirror-token inputs for custom Python distribution sources

[luhenry]

Description:

Users who need custom CPython builds (internal mirrors, GHES-hosted forks, special build configurations, compliance builds, air-gapped runners) could not previously point setup-python at anything other than actions/python-versions.

Adds two new inputs:

• mirror: base URL hosting versions-manifest.json and the Python distributions it references. Defaults to the existing https://raw.githubusercontent.com/actions/python-versions/main.
• mirror-token: optional token used to authenticate requests to the mirror.

If mirror is a https://raw.githubusercontent.com/{owner}/{repo}/{branch} URL, the manifest is fetched via the GitHub REST API (authenticated rate limit applies); otherwise the action falls back to a direct GET of {mirror}/versions-manifest.json.

This approach is largely inspired from how it's done in actions/setup-node

Token interaction

token is never forwarded to arbitrary hosts. Auth resolution is per-URL:

1. if mirror-token is set, use mirror-token
2. else if token is set AND the target host is github.com, *.github.com, or *.githubusercontent.com, use token
3. else send no auth

Cases:

Default (no inputs set)
  mirror = default raw.githubusercontent.com URL, mirror-token empty,
  token = github.token.
  → manifest API call and tarball downloads use `token`.
  Identical to prior behavior.

Custom raw.githubusercontent.com mirror (e.g. personal fork)
  mirror-token empty, token = github.token.
  → manifest API call and tarball downloads use `token`
    (target hosts are GitHub-owned).

Custom non-GitHub mirror, no mirror-token
  mirror-token empty, token = github.token.
  → manifest fetched via direct URL (no auth attached),
    tarball downloads use no auth.
  `token` is NOT forwarded to the custom host — this is the
  leak-prevention case.

Custom non-GitHub mirror with mirror-token
  mirror-token set, token may be set.
  → manifest fetch and tarball downloads use `mirror-token`.

Custom GitHub mirror with both tokens set
  mirror-token wins. Used for both the manifest API call and
  tarball downloads.

Related issue:

Fixes #1288

Check list:

• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[luhenry]

Relates to #1289

[luhenry]

I've verified it works as expected with https://github.com/riseproject-dev/riscv-runner-sample/actions/runs/24014042747/job/70030253499

[luhenry]

@gdams 👋 would you know who would be a good person to have a loot at that? That would greatly unblock riscv64 on github more generally. Thank you very much!

[gdams]

@gdams 👋 would you know who would be a good person to have a loot at that? That would greatly unblock riscv64 on github more generally. Thank you very much!

I'll ask around internally, just to clarify is your question Python specific or more generally about the state of riscv64 native runners?

[luhenry]

Merging that PR would enable a feature which would unblock users like using actions/setup-python on riscv64 runners, regardless where they are hosted. It would also enable other use cases like allowing Microsoft or any users of GitHub to point to their own builds of Python as well of course, which applies more broadly than just the support for riscv64.