Scope marketplace tokens to the steps that publish

VSCE_PAT and OVSX_PAT were set at the workflow level, so every step,
including pnpm install and the build, could read them. Only the vsce and
ovsx publish steps need them, so move the tokens onto those steps.

vsce show uses the public gallery API and does not need the PAT.

Assisted-By: devx/d9810122-2b8f-4f8d-b51b-eb980219e4b6