feat(artifact-registry): add glab artifact-registry get-token

Step 2 of artifact-registry#222. Depends on !3693 (merged) (step 1), so this MR targets sshen/ar-status and stacks on top of it.

Adds glab artifact-registry get-token, which exchanges the caller's GitLab session for a short-lived Artifact Registry access token and prints the bare token to stdout, so a shell can capture it directly:

TOKEN=$(glab artifact-registry get-token)

Like status, this command is EXPERIMENTAL, via text.ExperimentalString, in both --help and the generated docs.

The token line is written with fmt.Fprintln rather than LogInfo, matching token/create and token/rotate. LogInfo discards its write error, and this command's whole contract is stdout capture: a dropped write error would leave the caller with an empty $TOKEN and exit code 0.

Tests use an httptest server rather than gitlabtesting.NewTestClient, because token_exchange is not part of client-go's service surface, so there is no generated mock. The client calls it through gl.NewRequest and gl.Do.

No --scope flag: the token-exchange endpoint takes no scope parameter, and ADR-020's payload carries no role or scope claims. The Artifact Registry evaluates authorization per request (ADR-021).