Pass Github token to fetch schema-tools release

[ringods]

Because schema-tools is in another repository, the Github token needs to be passed to fetch it correctly.

Change needed to get the HCP provider release working: pulumiverse/pulumi-hcp#33
Current failing build: https://github.com/pulumiverse/pulumi-hcp/actions/runs/5175283385/jobs/9322680667

[pulumi]

🍹 The Refresh for pulumiverse/infra/prod was successful.

Resource Changes

    Name                       Type                                                        Operation
~   terraform-migration-guide  github:index/repository:Repository                          update
~   pulumi-vra_schmidtw        github:index/repositoryCollaborator:RepositoryCollaborator  update
~   pulumi-mssql               github:index/repository:Repository                          update
~   infra                      github:index/repository:Repository                          update
~   muhlba91                   github:index/membership:Membership                          update
~   pulumi-buildkite           github:index/repository:Repository                          update
~   pulumi-hcp                 github:index/repository:Repository                          update

[pulumi]

🍹 The Update (preview) for pulumiverse/infra/prod was successful.

Resource Changes

    Name                    Type                                                        Operation
+-  pulumi-exoscale_dirien  github:index/repositoryCollaborator:RepositoryCollaborator  replaced
+-  pulumi-aquasec_dirien   github:index/repositoryCollaborator:RepositoryCollaborator  replaced
~   pulumi-buildkite        github:index/repository:Repository                          update
+-  pulumi-vra_schmidtw     github:index/repositoryCollaborator:RepositoryCollaborator  replaced

[simenandre]

I'm unsure how the workflow works in its whole, but the ${{ github.token }} is scoped only to have access to this repository. Things might change when they are public however, but it's something to look out for :)

[ringods]

@simenandre I added this to a reusable workflow, meaning that "this repository" is not pulumiverse/infra, but the one calling this workflow, which in this case is pulumiverse/pulumi-hcp.

[simenandre]

By the way, permissions should probably be added. Newer repositories require that by default; we should consider requiring it for all our repositories/workflows.