Send the external repository token to the CLI

This commit does a few related things:

1. Bumps the minimum version for cli config parsing to 2.10.6
2. Ensures that if cli config parsing is enabled, then remove repos
   are _not_ downloaded by the action. It happens in the CLI.
3. Passes the `--external-repository-token-stdin` option to the CLI
   and passes the appropriate token via stdin if cli config parsing is
   enabled.

Author: aeisenberg

lib/analyze.js

@@ -262,6 +262,7 @@ export async function runQueries(
         logger.endGroup();
         logger.info(analysisSummary);
       } else {
+        // config was generated by the action, so must be interpreted by the action.
         logger.startGroup(`Running queries for ${language}`);
         const querySuitePaths: string[] = [];
         if (queries["builtin"].length > 0) {