Remove AuthHelper from attestation lookups

[asgrim]

The context for this change:

• Now that Composer 2.9 is released, I tried implementing the existing stuff with the new addAuthenticationOptions method.
• I noticed that the auth token wasn't actually returning anything; this is a bug that also affects PIE (currently investigating)
• When the token was being correctly provided, the attestation endpoint was giving me a 401 when using the Composer HttpDownloader. This was very odd, since a CLI curl command with a PAT DID work: curl -H "Authorization: token <redacted>" https://api.github.com/orgs/php/attestations/sha256:5ea836df7244a05d62b300a2294b5b6ae10c951f4f6a5e0d2ae2de84541142f0
• Since the attestations AP doesn't actually need auth when looking up public attestations, debugging this seemed kinda pointless

Therefore, this PR accepts a new limitation that this only works with public attestations for now. If we want to update to support private too, we can open a new issue to investigate further.