switched release workflow from PAT to GitHub App token authentication (#421)

Author: kaseywright

.github/workflows/cut-release.yml

@@ -11,10 +11,20 @@ jobs:
     permissions:
       contents: write
     steps:
+      - name: Mint App installation token
+        id: app-token
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+
       - uses: actions/checkout@v7.0.0
         with:
           fetch-depth: 0 # need full tag history to compute the next serial
-          token: ${{ secrets.BOT_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 
       - name: Compute CalVer tag