Use the x-access-token username form for cloned-repo credentials

[manasip-prog]

Dockerfile.xrpld built its authenticated clone URLs as https://<token>@github.com/..., which relies on the token being accepted as a bare username. That holds for personal access tokens but is not the form GitHub documents for GitHub App installation tokens, which is https://x-access-token:<token>@github.com/....

ripple/rippled-antithesis#112 moves the xrpld checkout onto an App installation token, so XRPLD_CREDENTIALS will carry a ghs_* token rather than a PAT. This switches both clone URLs to the documented form; it accepts PATs equally, so the fuzzer clone is unaffected either way.

🤖 Generated with Claude Code

[manasip-prog]

Verified on ripple/rippled-antithesis run 33918533062, which builds this branch against a GitHub App installation token:

#9 0.505 Cloning into '/root/xrpld'...
#9 2.687 + rm -rf /root/xrpld/.git

The xrpld clone succeeds with a ghs_* token through the x-access-token: form. That was the assumption this PR rests on, and it now has a run behind it rather than only the documentation.

The fuzzer clone in the same step fails, but on credentials rather than URL form — secrets.CREDENTIALS is the PAT that expired on 2026-09-02.