bypass Vercel deployment protection on preview API calls

action API calls to preview deployments were getting 401'd by Vercel's
deployment protection. add x-vercel-protection-bypass header to the 3
server-to-server fetch sites when VERCEL_AUTOMATION_BYPASS_SECRET is set.

Co-authored-by: Cursor <cursoragent@cursor.com>

utils/github.ts

@@ -2,7 +2,7 @@ import { createSign } from "node:crypto";
 import * as core from "@actions/core";
 import { throttling } from "@octokit/plugin-throttling";
 import { Octokit } from "@octokit/rest";
-import { getApiUrl } from "./apiUrl.ts";
+import { getApiUrl, getVercelBypassHeaders } from "./apiUrl.ts";
 import { retry } from "./retry.ts";
 
 export interface InstallationToken {
@@ -109,6 +109,7 @@ async function acquireTokenViaOIDC(opts?: AcquireTokenOptions): Promise<string>
       headers: {
         Authorization: `Bearer ${oidcToken}`,
         "Content-Type": "application/json",
+        ...getVercelBypassHeaders(),
       },
       signal: controller.signal,
     };