feat: #3633727: Keep the Mapillary access token out of exported configuration

Closes #3633727

A token saved on the API settings form is written in plain text to mapillary.settings.yml by drush config:export. A settings.php override already keeps a token out of the export, but nothing told a site about it, and an override does not remove a token saved earlier. This MR adds a status report entry and documents the fix.

Changes

• MapillaryHooks::runtimeRequirements() adds a "Mapillary access token" entry to the status report. It compares the overridden value with the stored one (getEditable() ignores overrides, so it shows what an export writes):
  • overridden, nothing stored: OK
  • stored, not overridden: Info, with a pointer to the README
  • overridden and stored: Warning, with drush config:set mapillary.settings access_token '' to remove the stored token
  • neither: Warning
• mapillary_post_update_access_token_requirement() is an empty post update, so drush updatedb rebuilds the container and finds the new hook implementation.
• README: a section on reading the token from an environment variable in settings.php, removing the stored value, replacing a token that was already committed, and why ignoring the file in git or using Config Split does not solve it. It also says that the Key module will be used for site-wide secrets when OAuth sign-in is added.
• AccessTokenRequirementsTest covers the four states and checks that the token value never appears in the report.
• CHANGELOG ("Added", with a note to run drush updatedb) and AGENTS.md.

Not changed

• The API settings form: no button to remove the stored token, since the Drush command does it and the status report names it.
• No schema or configuration change, so no update hook and no update path test.
• No new dependency. The Key module comes with OAuth.

Testing

Run locally on Drupal 11 with PostgreSQL: AccessTokenRequirementsTest (4 tests), all Kernel tests of the base module (30 tests), phpcs (Drupal, DrupalPractice) and phpstan level 6. The full run, MySQL and Drupal 12 are left to the pipeline.