generate codeartifact token in CI, allow non-appfolio members to yarn install

[JeremyRH]

GitHub workflow secrets for public repos

A public repo's GitHub workflows should have NO access to secrets. Secrets can be seen here: https://github.com/appfolio/<repo_name>/settings/secrets/actions.
This is to prevent actors from pushing a branch with a workflow that extracts secrets.

Secrets can instead be accessed through repo environments: https://docs.github.com/en/actions/how-tos/deploy/configure-and-manage-deployments/manage-environments
Authorized teams must manually approve workflows that use environments before the workflow can proceed.
Essentially, we use environments to protect secrets from being accessed by unauthorized actors.

Why not use the "Require approval for all external contributors" setting in https://github.com/appfolio/<remo_name>/settings/actions?
We do set that but it is not clear if this applies to all PRs or just fork PRs. Additionally, any AppFolio member can approve workflows, increasing the chance of someone approving a workflow without reviewing the changes.

Using a private package registry for public repos

We do not want to expose our private registry URL or access keys for obvious reasons.
We can store these values in environment secrets and use them in protected workflows (see above).

Members of AppFolio should have these values locally, enabling local development.
Non-AppFolio contributors can use the public package registry with an opt-in flag. In the case of react-gears, it's this:

YARN_RC_FILENAME=.yarnrc-public.yml yarn install

Workflows that do not require secrets can also use the above command and do not need to use an environment. The test/lint workflow in react-gears does this.

[github-actions]

Released prerelease version 8.17.1-fee-secure-oss-9c493fc.0.
You may now run npm install @appfolio/react-gears@fee-secure-oss