release: take the GHCR token on stdin, not argv

A token passed as -p is readable from the process list for the life of the
command. crane reads it from stdin instead. Pins crane to v0.21.7, the version
the copy and digest-verify steps were exercised against.

Co-authored-by: Hanzo Dev <[email protected]>

.hanzo/workflows/release.yml

@@ -226,7 +226,7 @@ jobs:
         # identical content, which defeats the check below.
         run: |
           set -euo pipefail
-          ver=v0.20.2
+          ver=v0.21.7
           curl -fsSL "https://github.com/google/go-containerregistry/releases/download/${ver}/go-containerregistry_Linux_x86_64.tar.gz" \
             | tar -xz -C /usr/local/bin crane
           crane version
@@ -239,7 +239,9 @@ jobs:
           set -euo pipefail
           SRC='${{ needs.build.outputs.probe }}'
           TAG='${{ needs.build.outputs.git_tag }}'
-          crane auth login ghcr.io -u "$GHCR_USER" -p "$GHCR_TOKEN"
+          # --password-stdin, not -p: a token in argv is readable from the
+          # process list for as long as the command runs.
+          printf '%s' "$GHCR_TOKEN" | crane auth login ghcr.io -u "$GHCR_USER" --password-stdin
 
           WANT="$(crane digest "$SRC")"
           echo "source ${SRC} is ${WANT}"