chore: add devhub-environment input to just-nuts workflows @W-24095410@

[WillieRuemmele]

Summary

• Adds an optional devhub-environment input to just-nut.yml and just-nuts.yml
• When specified, the job runs under that GitHub Environment, whose secrets override the default org-level TESTKIT_* credentials
• When unspecified (default), behavior is identical to today — org-level secrets resolve as always

Why

@W-24095410@ — We need to run NUTs against different devhub configurations (e.g., a connected app with JWT-based access tokens enabled) without swapping org-level secrets and remembering to revert.

Previously, the only way to change which org NUTs authenticate against was to overwrite the org-level TESTKIT_AUTH_URL / TESTKIT_JWT_* secrets — risky, not reversible without backups, and affects all workflows.

How it works

1. Create a GitHub Environment (e.g., devhub-gs0-jwt) at repo Settings > Environments
2. Add only the secrets that differ (client ID, key, username, instance) — everything else falls through to org-level
3. Pass the environment name when triggering:

   gh workflow run just-nuts.yml -f channel-or-version=nightly -f devhub-environment=devhub-gs0-jwt

Test plan

• Run just-nuts with no devhub-environment — should behave identically to today
• Create a devhub-gs0-jwt environment with GS0 JWT credentials
• Run just-nuts with -f devhub-environment=devhub-gs0-jwt — should use environment secrets
• Verify NUTs that use streaming/CometD fail with JWT tokens (confirming the environment override works)

[github-actions]

This PR lacks any commits of the 'fix' or 'feat' type, and therefore will not trigger a release. To silence all further warnings, react to this warning comment (or any other) with the 👀 emoji.

NOTE: If your repo uses squash commits, make sure to add the appropriate conventional commit prefix (e.g., 'fix:', 'feat:', 'chore:', etc) in the squash commit message.