FRE-4807: Remediate security review Medium findings

- Add SHA256 verification for k6 binary download (supply chain integrity)
- Remove literal 'test-token' fallback for API_TOKEN in CI workflow;
  add validation step that fails if LOAD_TEST_API_TOKEN secret is missing
- Replace 'test-token' fallback with empty string + warning in run-all.sh
- Replace 'test-token' fallback with empty string in all 4 service scripts

scripts/load-test/services/darkwatch.js

@@ -32,7 +32,7 @@ export const options = {
 };
 
 const BASE_URL = getBaseUrl();
-const AUTH_TOKEN = __ENV.API_TOKEN || 'test-token';
+const AUTH_TOKEN = __ENV.API_TOKEN || '';
 
 const headers = {
   'Content-Type': 'application/json',