Fix GHA access to private repos in org

[jeremyestein]

Should be a more resilient fix for private repo access now that our PAT has expired.

Only use read-only creds.

As per https://uclh.slab.com/posts/setting-up-a-github-app-to-commit-to-a-repository-2sjfd3ae

[jeremyestein]

closing and re-opening to force the PR checklist to re-run

[github-actions]

PR checklist

Default guide for a PR (if multiple PRs for the work, only keep one version of it and link to it on the other PRs)

• From the UCLH data science desktop, a validation run has been set off
• Check that content that reveals Epic IP (eg. Clarity/Caboodle queries) has not been checked into a public repo.
• load times
  in UCL teams has been populated with the run information
• During the run, glowroot has been checked for any queries which are taking a substantial proportion of the
  total processing time. This can be useful to identify indexes that are required.
• After the run, look for any unexpected errors in the etl_per_message_logging table, the error_search.sql file
  on the shared drive can be used for this \\sharefs6\UCLH6\EMAP\Shared\EmapSqlScripts\devops\error_search.sql.
  Create an issue if you find an unexpected exception and is not related to the changes you've made, otherwise
  fix them!
• After the run, populate the end time in
  load times
• Let Aasiyah know about the completed validation and give her information on the changes and where to start
  with the validation
• Check validation report and give any feedback to Aasiyah if there are any changes needed on her side,
  iterate on getting the validation to match at least 99% (validation and emap code).