fix: use GitHub App token for release-please workflow

[dlevy-msft-sql]

Problem

The release-please workflow fails with:
\
GitHub Actions is not permitted to create or approve pull requests
\\

The org policy blocks enabling 'Allow GitHub Actions to create and approve pull requests' in repository settings.

Solution

Use a GitHub App for authentication instead of \GITHUB_TOKEN. This is also more secure than using a PAT:

Feature	PAT	GitHub App
Tied to user account	✅ Yes (risk)	❌ No
Token rotation	Manual	Automatic (1 hour)
Survives user leaving org	❌ No	✅ Yes
Audit trail	User actions	App-specific logs

Setup Required

After merging, add these repository secrets:

1. **\RELEASE_PLEASE_APP_ID**: The GitHub App ID
2. **\RELEASE_PLEASE_APP_PRIVATE_KEY**: The GitHub App private key (.pem file contents)

Creating the GitHub App

1. Go to org settings → Developer settings → GitHub Apps → New GitHub App
2. Permissions needed:
   • Contents: Read and write
   • Pull requests: Read and write
3. Install the app on this repository
4. Generate a private key

Changes

• Add \create-github-app-token\ step to generate token from App credentials
• Pin actions to commit SHAs for supply chain security
• Use app token for release-please-action

Fixes the release-please workflow failure.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 75.32%. Comparing base (5718c41) to head (35534e5).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #324      +/-   ##
==========================================
- Coverage   75.46%   75.32%   -0.14%     
==========================================
  Files          34       34              
  Lines        6598     6598              
==========================================
- Hits         4979     4970       -9     
- Misses       1333     1338       +5     
- Partials      286      290       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.