Mark the token for masking in GHA logs

[webknjaz]

This is almost the same as codecov/codecov-action#1498, except the action only knows of things incoming through the action inputs interface. But codecov-cli has a better context available:

1. It can be called @ GHA directly w/o that action and should still be able to detect the environment where it's being executed
2. It can read token from a config file and codecov/codecov-action wouldn't know about that so it wouldn't be able to mask it

Action item:

• print(f'::add-mask::{token}', file=sys.stderr) per https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#example-masking-a-string as soon as it's known in the program