fix: update coc-test for authenticated release downloads

[chemzqm]

Summary

• Bump coc-test from ^0.2.0 to ^0.2.2 and refresh only its lockfile entry.
• Use the upstream downloader fix that reads GITHUB_TOKEN (already supplied by Daily release) for GitHub release-ref and archive requests, avoiding the anonymous API rate limit seen in run 38043720332.
• Keep release workflows and published package version unchanged.

Validation

• npm ci (Node 24.19.0, npm 11.9.0): passed
• npm run build: passed
• npm run lint: passed
• git diff --check: passed
• Mocked-fetch check against installed coc-test 0.2.2: GITHUB_TOKEN is attached to both release-ref and archive requests; no real credentials used or transmitted.
• Local npm test: blocked at release-ref lookup by this environment's anonymous GitHub API 403; this environment also has neither editor installed.
• PR CI run 38045574387: passed for commit 0235b68. Both Neovim and Vim lanes passed dependency installation, typecheck, and integration tests.

Upstream fix: https://github.com/neoclide/coc-test/blob/4cd4b81cd710dd6d0686e09d6c61b42c6fe0160c/src/download.ts#L10-L21