This pull request updates the GitHub Actions workflows for documentation, AWS CLI completer scripts, and .NET install script automation. The main goal is to improve security by replacing the use of a personal access token (PAT) with a GitHub App token for authentication, and to reduce workflow permissions to the minimum required.

Authentication and Permissions Improvements:

• Replaced the use of secrets.PAT with a GitHub App token generated via the actions/create-github-app-token@v2 action for all workflows (update-documentation.yml, update-aws-cli-completer-scripts.yml, and update-dotnet-install-script.yml). The App ID and private key are now sourced from devcontainers organization variables and secrets. [1] [2] [3]
• Updated the GITHUB_TOKEN environment variable in the PR creation steps to use the newly generated GitHub App token instead of the PAT. [1] [2] [3]
• Reduced workflow permissions from contents: write and pull-requests: write to contents: read, following the principle of least privilege. [1] [2] [3]

Workflow Steps Updates:

• Modified the checkout steps to use the generated GitHub App token for repository access, ensuring all git operations use the correct authentication context. [1] [2] [3]

Prerequisites:

• devcontainers-repos-automation GitHub App registered on the org and installed on devcontainers/features (Contents R/W, Pull requests R/W, Issues R/W, Metadata R).
• Org variable DEVCONTAINERS_REPO_AUTOMATION_ID and org secret DEVCONTAINERS_REPO_AUTOMATION_PRIVATE_KEY added, scoped to this repo.

These changes enhance workflow security and align with GitHub's best practices for automation and token management.