fix(ci): avoid nix trying to use GH access-token

The GITHUB_TOKEN env var is set on each step by
https://code.forgejo.org/forgejo/runner, but only to communicate with
forgejo to access the repo (if it is private)

error: unable to download '4e422edf6b': HTTP error 401

.forgejo/workflows/check.yml

@@ -47,4 +47,4 @@ jobs:
 
       - name: Run flake checks
         run: |
-          nix --print-build-logs --verbose --accept-flake-config flake check
+          nix --print-build-logs --verbose --accept-flake-config --access-tokens '' flake check