Use of Stolen API Keys/Tokens

Use a previously obtained GitLab personal access token as an application access token to authenticate to GitLab's REST API and access resources permitted by the token's scopes and the account's project access. The concrete steps confirm the authenticated user, list a page of visible projects, and retrieve one in-scope repository file. They demonstrate token use; acquiring the token is a separate action, and the commands do not cover session-cookie replay.