cli: default to XDG_CONFIG_HOME/damspam/spambot.token for the gitlab token
If neither --token-file nor --token-env are given, default to that token. We use spambot.token because in most cases this is the token to impersonate @spambot and this way we keep it separate from a potential future user token.