ci: Start using external secret for ADD_JH_FILES_TOKEN

What does this MR do and why?

After the successful PoC that we made at !143201 (closed), we're ready to start using external secrets from GSM.

We start with a single token: ADD_JH_FILES_TOKEN for now.

The original attempt was reverted by !144038 (merged) since it broke dev.

Related to gitlab-org/quality/engineering-productivity/team#363, #440807 (closed).

Test matrix

• as-if-jh don't run on dev