Provide a hint when `gitHubLatestReleaseAssetURL` results in a `401 Bad credentials`

Is your feature request related to a problem? Please describe.

When gitHubLatestReleaseAssetURL fails because of a 401 Bad credentials, the user doesn’t really know why it failed, even with chezmoi apply --verbose.

For example:

❯ chezmoi apply --verbose
chezmoi: C:/Users/mcourbet/.local/share/chezmoi/.chezmoiexternal.yaml.tmpl: template: .chezmoiexternal.yaml.tmpl:33:10: executing ".chezmoiexternal.yaml.tmpl" at <gitHubLatestReleaseAssetURL "jtroo/kanata" "windows-binaries-x64.zip">: error calling gitHubLatestReleaseAssetURL: GET https://api.github.com/repos/jtroo/kanata/releases/latest: 401 Bad credentials []

I realized that my GitHub auth token had expired.

Describe the solution you'd like

Two problems should be addressed here:

1. gitHubLatestReleaseAssetURL (or any gitHub* function family) should show which of the eligible GitHub token env var has been used to authenticate to the API.
2. A message describing the most common causes should be displayed, one of which is that the GitHub authentication token has expired. Ideally, a direct link to the token renewal page (https://github.com/settings/personal-access-tokens/xxxxx/regenerate) should be clickable to help the user. If not possible, a link to the token list page should be enough.