Authenticated HTTPS fallback for SSH-declared private dependencies

On private dependencies, the SSH → HTTPS fetch fallback used by swifterpm now sends the same GITHUB_TOKEN/GH_TOKEN/GITLAB_TOKEN/etc. credentials that the API-tarball path already discovered, via git -c http.<base>.extraheader=Authorization:.... The token never gets written to on-disk git config, and SSH candidates still rely on ssh-agent unchanged. When all candidates fail the error now lists every attempted URL and its individual cause instead of just the last one, so SSH-declared private dependencies in CI are far more likely to fetch.