[Tests] nvm_download: point the httpbin Authorization check at a configured mirror

The httpbin check sends `$NVM_AUTH_HEADER` to `http://127.0.0.1/bearer` without configuring a mirror.
Set `$NVM_NODEJS_ORG_MIRROR` to that host,
as a real user of the header would,
so the check keeps exercising the header once it is only sent to URLs under a mirror

Discovered by Anthropic's OSS Scanner, as ANT-2026-YPW87EDH; the scanner reported it as a vulnerability, but it is not one.

test/fast/Unit tests/nvm_download

@@ -29,7 +29,7 @@ done
 if [ "${httpbin_pulled}" = 1 ] && SHELL=bash docker run -d --name httpbin -p 80:80 kennethreitz/httpbin; then
   sleep 1 # wait for httpbin to start
   # nvm_download should pass when calling with auth header
-  NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /dev/null || die 'nvm_download with auth header should send correctly'
+  NVM_NODEJS_ORG_MIRROR="http://127.0.0.1" NVM_AUTH_HEADER="Bearer test-token" nvm_download "http://127.0.0.1/bearer" > /dev/null || die 'nvm_download with auth header should send correctly'
   # nvm_download should fail when calling without auth header
   nvm_download "http://127.0.0.1/bearer" > /dev/null && die 'nvm_download with no auth header should not send the header and should fail'
 else