IBX-11778: Updated deprecated GitHub Actions in tag-triggered workflows

[alongosz]

🎫 Issue	IBX-11778

Related PRs:

• IBX-11778: [GHA] Updated deprecated versions of GitHub actions gh-workflows#103
• IBX-11778: Updated deprecated GitHub Actions in browser-tests workflow experience-skeleton#9
• IBX-11778: Updated deprecated GitHub Actions in browser-tests workflow headless-skeleton#4
• IBX-11778: Updated deprecated GitHub Actions in browser-tests workflow oss-skeleton#10
• IBX-11778: Updated GitHub Actions to latest versions documentation-developer#3345

Description:

Upgraded or replaced the GitHub Actions in the tag-triggered browser-tests.yaml and api_refs.yaml workflows that still run on the deprecated Node.js 20 runtime (to be removed from GitHub runners on September 16th, 2026):

• Bumped actions/create-github-app-token from v2 to v3, switching the deprecated app-id input to client-id;
• Replaced octokit/request-action@v2.x workflow-dispatch calls with gh api --method POST, which also drops the !!str ref workaround;
• Upgraded the runner to ubuntu-26.04.

The release_tag.yaml workflow only calls the ibexa/gh-workflows/...@main reusable workflow (deliberately trunk-tracking, already covered by ibexa/gh-workflows#103) and required no changes.

For QA:

The browser-tests dispatch idiom (create-github-app-token@v3 + gh api --method POST) is tested identically to ibexa/oss-skeleton — see oss-skeleton#10's "For QA". The api_refs dispatch shares the same idiom.

Test status:

• 🟢 workflow_dispatch mock of the api_refs payload in ibexa/gha-testing, pointed at a receiver in the same repo instead of ibexa/documentation-developer Skeleton Dispatch Trigger run 31096752598 — token generated via create-github-app-token@v3/client-id, gh api --method POST dispatch succeeded, receiver logged version: v5.0.9 Dispatch Receiver run 31096762025 — same value the retired octokit/request-action JSON payload carried

Note: dispatching the real documentation-developer api_refs.yaml with this payload (an existing tag, v5.0.9) was attempted and cancelled before the commit/PR step — that workflow still runs on create-github-app-token@v2 / ubuntu-latest and needs its own update pass, tracked separately.

Documentation:

No documentation required.