ci: use GitHub app for ephemeral tokens

[v1v]

What does this PR do?

Use the GitHub app to generate the required ephemeral tokens with the least permissive principle.

Why

• Finer-grained tokens with Service Machine accounts are required to rotate the secrets manually.
• GitHub app to generate temporary tokens is the advanced approach to avoid the above
• Document what the GH workflow requires to run in terms of access
• GitHub Token with Permissions does not trigger GitHub builds

Implementation details

Use tibdex/github-app-token with the required permissions and the repository scope
Remove the permissions configuration in the GH workflow.
Configure git checkout with the ephemeral token
Configure the GH_TOKEN with the ephemeral token

[v1v]

We could try with ${{github.event.repository.name}} instead of a hardcoded value, but need to figure out if those details are available when running this workflow.

For now we can use a hardcoded value