Fix Rack Attack incorrectly rate limiting runner API

To update a job status, the runner uses the PUT /api/v4/:jobs endpoint
with the job token in two places:

1. The PRIVATE-TOKEN header
2. The `token` parameter in the JSON body

Previously `AuthFinders` looked up the PAT and raised an unauthorized
exception because no user was found. Instead, it should continue to
see if it can authenticate the job with the `token` parameter.

This commit makes `access_token` return blank if it has the CI build
token prefix so that the exception is not raised. That way Rack Attack
can then ensure the request is authenticated with the job token.

Changelog: fixed