Use organization-managed access tokens

[Zeitsperre]

Pull Request Checklist:

• This PR addresses an already opened issue (for bug fixes / features)
  • This PR fixes #xyz
• (If applicable) Documentation has been added / updated (for bug fixes / features).
• (If applicable) Tests have been added.
• CHANGES.rst has been updated (with summary of main changes).
  • Link to issue (:issue:number) and pull request (:pull:number) has been added.

What kind of change does this PR introduce?

• Updates Workflows to use Organization-scoped Access Tokens
• Updates workflow permissions to be very explicit (easier to understand what access is being used/asked for by each)

Does this PR introduce a breaking change?

No.

Other information:

The ACTIONS_VERSIONS_UPDATER_TOKEN and the BUMP_VERSION_TOKEN are Organization-scoped (Hydrologie) personal access tokens with the following permissions for repositories xhydro, xdatasets and xhydro-testdata:

ACTIONS_VERSIONS_UPDATER_TOKEN:

• Contents: Read and Write
• Metadata: Read-Only
• Pull Requests: Read and Write
• Workflows: Read and Write

BUMP_VERSION_TOKEN:

• Contents: Read and Write
• Metadata: Read-Only
• Pull Requests: Read and Write

Both are set to expire on January 1st, 2025. After this point, anyone with maintainer access can generate new tokens and ask the Hydrologie admins to update the tokens so that workflows continue operating as normal.

For more information: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens