[8.15] github-action: use ephemeral tokens with the required permissions (backport #14010)

[mergify]

Details

⚠️ This PR was created by an automated tool. Please review the changes carefully. ⚠️

What

Use https://github.com/tibdex/github-app-token to generate ephemeral tokens with the required
permissions only

This is the alternative to moving away from finer-grained GitHub tokens and reducing the
cumbersome of rotating them as we do nowadays.

Implementaiton details

We have used the same GitHub action in other places.

If there are any questions, please reach out to the @elastic/observablt-ci

---

This is an automatic backport of pull request #14010 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of abb9a9b has failed:

On branch mergify/bp/8.15/pr-14010
Your branch is up to date with 'origin/8.15'.

You are currently cherry-picking commit abb9a9b09.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   .github/workflows/bump-elastic-stack.yml
	modified:   .github/workflows/update-beats.yml

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   .github/workflows/bump-golang.yml
	both modified:   .github/workflows/update-compose.yml

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally