ci: use scoped GitHub App token for dependency PRs

[egorsmkv]

Dependency PRs created with GITHUB_TOKEN leave matching pull_request workflows awaiting maintainer approval. Generate a short-lived GitHub App installation token immediately before create-pull-request and use it for branch push and PR creation/update. Scope it to the current repository with Contents and Pull requests write permissions; keep GITHUB_TOKEN read-only and disable persisted checkout credentials.

Setup required before merging:

• Install a GitHub App on this repository with Contents: read/write, Pull requests: read/write, and mandatory Metadata: read-only. No Actions or Workflows write permissions are needed.
• Configure repository variable DEPENDENCY_APP_CLIENT_ID and secret DEPENDENCY_APP_PRIVATE_KEY (PEM). actions/create-github-app-token@v3 uses client-id; no actual credentials are included in this PR.

Existing waiting runs still need maintainer 'Approve workflows to run'. Existing test.yaml/audit.yaml and their path filters are unchanged. App-authenticated pushes may trigger both push and pull_request checks.

Validation: exact patches passed git apply --check and trial application; uploaded workflow content was read back and matched. Live scheduled execution requires the App setup above.