ci: authenticate HuggingFace model prefetch to avoid rate limits (#1948)

## What?
The shared CI egress was being rate-limited by HuggingFace on anonymous
requests, causing the vLLM and SGLang sanity stages to fail during
Qwen/Qwen3-8B prefetch.

Bind the svc-nixl-hf-token Jenkins secret text credential as HF_TOKEN in
the build-wheel pipeline and pass it through to the sanity testScript so
snapshot_download authenticates rather than hitting the anonymous rate
limit.

## Why?
rate limit failing build-wheel pipeline on rare occasions 

## How?
_It is optional, but for complex PRs, please provide information about
the design,
architecture, approach, etc._


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved vLLM and SGLang aarch64 CI sanity checks by routing model
prefetch through an internal Hugging Face mirror endpoint when provided.
* Increased prefetch reliability by extending Hugging Face
metadata/download timeouts during the CI sanity prefetch flow.

* **Documentation**
* Updated the CI overview to clarify dispatcher-triggered sanity
prefetch uses the internal mirror (not `huggingface.co`) and how the
mirror endpoint is supplied to the SLURM sanity container.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: NirWolfer <nwolfer@nvidia.com>