[BRE-1670] replace PAT tokens with app token

[AmyLGalles]

🎟️ Tracking

BRE-1670

📔 Objective

Updating github workflows that use PAT to use bot token or GITHUB_TOKEN instead.

In some cases, the PAT token was being used for simple repo actions that didn't require further authentication, such as reading from or cloning a public repository.

For signing commits to other repos, actions/checkout native signing is available

📸 Screenshots

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Checkmarx One – Scan Summary & Details – e0f43be8-3c99-438a-875d-221de57892fd

---

New Issues (6)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 307	details Method at line 307 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from organizationUser... Attack Vector
2		CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 307	details Method at line 307 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par... Attack Vector
3		CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 531	details Method at line 531 of /src/Api/AdminConsole/Controllers/OrganizationUsersController.cs gets a parameter from a user request from model. This par... Attack Vector
4		CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105	details Method at line 105 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi... Attack Vector
5		CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 105	details Method at line 105 of /src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs gets a parameter from a user request from model. Thi... Attack Vector
6		SSL_Verification_Bypass	/src/Core/Platform/Mail/Delivery/MailKitSmtpMailDeliveryService.cs: 84	details /src/Core/Platform/Mail/Delivery/MailKitSmtpMailDeliveryService.cs relies HTTPS requests, in . The ServerCertificateValidationCallback parameter,... Attack Vector

---

Fixed Issues (7)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CSRF	/src/Api/Billing/Controllers/VNext/AccountBillingVNextController.cs: 55
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 145
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
	CSRF	/src/Api/KeyManagement/Controllers/AccountsKeyManagementController.cs: 97
	CSRF	/src/Api/AdminConsole/Controllers/OrganizationUsersController.cs: 512
	SSL_Verification_Bypass	/src/Core/Platform/Mail/Delivery/MailKitSmtpMailDeliveryService.cs: 81

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.45%. Comparing base (1bc5f4e) to head (0b012c3).
⚠️ Report is 148 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7434      +/-   ##
==========================================
- Coverage   61.81%   58.45%   -3.36%     
==========================================
  Files        2035     2067      +32     
  Lines       89647    90997    +1350     
  Branches     7994     8083      +89     
==========================================
- Hits        55413    53196    -2217     
- Misses      32288    35900    +3612     
+ Partials     1946     1901      -45     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.