ci: use GitHub app for ephemeral tokens

[v1v]

What

Use the GitHub app to generate the required ephemeral tokens with the least permissive principle.

Why

• Finer-grained tokens with Service Machine accounts are required to rotate the secrets manually.
• GitHub app to generate temporary tokens is the advanced approach to avoid the above
• Document what the GH workflow requires to run in terms of access
• GitHub Token with Permissions does not trigger GitHub builds

Implementation details

Use tibdex/github-app-token with the required permissions and the repository scope
Remove the permissions configuration in the GH workflow.
Configure git checkout with the ephemeral token
Configure the GH_TOKEN with the ephemeral token