ci: fetch the release tag with basic auth

GitHub's git endpoint rejects a bearer header; it takes the job token as the
password of x-access-token, as actions/checkout does. The release tag is also
resolved in the job environment.

.github/workflows/release.yml

@@ -31,7 +31,8 @@ jobs:
         run: |
           case "$RELEASE_REF" in v[0-9]*.[0-9]*.[0-9]*) ;; *) echo "not a version tag: $RELEASE_REF" >&2; exit 1 ;; esac
           git init -q .
-          git -c http.extraheader="AUTHORIZATION: bearer $GITHUB_TOKEN" fetch -q --depth 1 \
+          basic=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
+          git -c http.extraheader="AUTHORIZATION: basic $basic" fetch -q --depth 1 \
             "https://github.com/$GITHUB_REPOSITORY" "refs/tags/$RELEASE_REF:refs/tags/$RELEASE_REF"
           git checkout -q "refs/tags/$RELEASE_REF"
       - name: Install Node