Fix update-cloudformation-actions workflow IP allowlist issue

Use GitHub App token instead of GITHUB_TOKEN to work around Skyscanner's
IP allowlist restrictions on public repos with GitHub-hosted runners.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: jsoucheiron

.github/workflows/update-cloudformation-actions.yml

@@ -36,10 +36,17 @@ jobs:
         id: date
         run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"
 
+      - name: Generate GitHub App token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        id: app-token
+        with:
+          app-id: ${{ vars.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: "Update CloudFormation actions"
           title: "Update CloudFormation actions (${{ steps.date.outputs.date }})"
           body: |