fix(security): move mapbox token to env variable

[contolini]

Adds a Mapbox environment variable that Vite injects at build time. Even though the token is sent with all client-side requests and not a secret, it's good practice to keep tokens like this in an environment variable.

See #4812
Fixes #2479

Changes

• MAPBOX_ACCESS_TOKEN needs to be defined in the root .env file.
• Documentation in the readme describing the new env variable.
• New .env.example file with placeholder variables.
• Fails early if Mapbox token isn't defined with descriptive error message.

Testing

1. yarn build and yarn start should work as expected when MAPBOX_ACCESS_TOKEN is defined and fail when it's undefined.

Notes

• Ignore all the imports that were automatically alphabetized by our linter.
• Vite automatically imports env variables that start with VITE_ but IMHO it's confusing and ugly to name the variable VITE_MAPBOX_ACCESS_TOKEN so I manually defined the variable in Vite's config per their guidance.
• ESLint complains about the import.meta usage so I edited its config to ignore it. Modern versions of ECMAScript are fine with it but if we set "ecmaVersion": "latest" in our ESLint config, it throws a bajillion other errors because the app's coding style is antiquated.
• I added the Mapbox token to this repo's environment variables under settings so that GitHub Actions has access to it.