Replace workflow PAT usage with GitHub App authentication #14410

The label-issues, label-pr, and DevFlow PR review workflows rely on user-scoped tokens for GitHub API writes. Reduced PAT lifetimes make this operationally fragile.

Use the dedicated semantic-kernel-automation GitHub App with GitHub Actions OIDC and Azure Key Vault HSM server-side signing to mint short-lived, repository-scoped installation tokens. Retain the existing PAT only as a temporary rollout fallback, and keep Copilot authentication on the built-in Actions token.