Merge BlockstreamResearch/secp256k1-zkp#351: sync-upstream: Use GITHUB_TOKEN for gh commands

efa4e11b65 sync-upstream: Use GITHUB_TOKEN for gh commands (DarkWindman)

Pull request description:

  Optimize token usage in the sync workflow.

  **Token usage:**
  - **PAT** : Used for `git push` operations that modify workflow files
  - `GITHUB_TOKEN`: Used for GitHub CLI commands (`gh repo set-default`, `gh pr create`)

ACKs for top commit:
  real-or-random:
    ACK efa4e11b65

Tree-SHA512: 9deb68d74e69ac1a3f6785f04132aef8c3357d326e9e9efe9a86842db12972a46f81f124dd3ddda7425ebd3ddd86cfd4905006fe20ae9d9ca0f0be07bca64891

.github/workflows/sync.yml

@@ -6,7 +6,6 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
   pull-requests: write
 
 jobs:
@@ -33,7 +32,7 @@ jobs:
       - name: Fetch upstream & generate branch name & check for new commits
         id: check_commits
         env:
-          GH_TOKEN: ${{ secrets.SYNC_PAT }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh repo set-default ${{ github.repository }}  # Set the default repo to the origin repository
           git remote add upstream ${{ env.UPSTREAM }}
@@ -83,7 +82,7 @@ jobs:
         id: create_pr
         if: steps.check_commits.outputs.skip == 'false'
         env:
-          GH_TOKEN: ${{ secrets.SYNC_PAT }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Execute the generated PR creation script
           ./contrib/gh-pr-create.sh