Use more secure GitHub token in GH action

[nikhilwoodruff]

          __suggestion:__ I believe this use of the token opens us up to security concerns; can we use the federated token pattern we use elsewhere?

Originally posted by @anth-volk in #105 (comment)

[vahid-ahmadi]

This has been addressed. Commit 20e36c9 (PR #293) replaced the expired PAT with a GitHub App token (actions/create-github-app-token@v1).