[Fix] nvm_download: pass $NVM_AUTH_HEADER to curl and GNU Wget in a config file, not as an argument

The header was passed as a `--header` argument, so it was readable by anyone who could see the downloader's command line.

curl now reads it as `header = "…"` from a config on stdin (`--config -`); the sanitized value can contain neither `"` nor `\` nor a line break, so it cannot escape the quoted string or add another option.
GNU Wget only reads a config file that is a regular file, so a subshell writes the header to a `mktemp` file in `$TMPDIR` (mode 0600), after a copy of the user's `$WGETRC` or `~/.wgetrc`, which that file replaces, and points `WGETRC` at it;
traps on EXIT, HUP, INT, and TERM remove it, and `WGETRC` never reaches the user's shell.
BusyBox wget reads no config file and has no option for one, so it still gets the header as an argument; the README recommends curl on shared machines.

Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-540RL2U6.

test/fast/Unit tests/nvm_wget_same_origin

@@ -61,11 +61,11 @@ chmod +x "$TEST_BIN/wget"
 export CALL_LOG
 export PATH="$TEST_BIN:$OLDPATH"
 
-# the Authorization header goes along with every request
-HEADER='<--header><Authorization: Bearer test-token>'
+# the Authorization header comes from $WGETRC, never from an argument
+HEADER=''
 run() {
   : > "$CALL_LOG"
-  try_err nvm_wget_same_origin 'Bearer test-token' "$@"
+  try_err nvm_wget_same_origin "$@"
 }
 
 # args: description, expected calls (one per argument)