Switch [OpenCollective] badges to use GraphQL and auth (#9387)

* [OpenCollective] update opencollective to api v2 (#9346)

* update opencollective to api v2

* fix tests

* fix: do not filter by accountType for opencollective/all

* remove 404

* remove required in schema

* cnt -> count

* keep by-tier code as-is

---------

Co-authored-by: repo-ranger[bot] <39074581+repo-ranger[bot]@users.noreply.github.com>

* allow calling OpenCollective api with an auth token

* add test for opencollective auth

* cache OpenCollective badges for longer

---------

Co-authored-by: xxchan <xxchan22f@gmail.com>
Co-authored-by: repo-ranger[bot] <39074581+repo-ranger[bot]@users.noreply.github.com>

doc/server-secrets.md

@@ -231,7 +231,7 @@ installation access to private npm packages
 
 [npm token]: https://docs.npmjs.com/getting-started/working_with_tokens
 
-## Open Build Service
+### Open Build Service
 
 - `OBS_USER` (yml: `private.obs_user`)
 - `OBS_PASS` (yml: `private.obs_user`)
@@ -246,6 +246,14 @@ they can only be scoped to execute specific actions on a POST request. This
 means however, that an actual account is required to read the build status
 of a package.
 
+### OpenCollective
+
+- `OPENCOLLECTIVE_TOKEN` (yml: `opencollective_token`)
+
+OpenCollective's GraphQL API only allows 10 reqs/minute for anonymous users.
+An [API token](https://graphql-docs-v2.opencollective.com/access)
+can be provided to access a higher rate limit of 100 reqs/minute.
+
 ### SymfonyInsight (formerly Sensiolabs)
 
 - `SL_INSIGHT_USER_UUID` (yml: `private.sl_insight_userUuid`)