Merge BlockstreamResearch/secp256k1-zkp#348: sync-upstream: Allow PAT for sync workflow

3a18afd5ff sync-upstream: Allow PAT for sync workflow (DarkWindman)

Pull request description:

  Add support for using a Personal Access Token in the upstream sync workflow. The workflow now uses `secrets.SYNC_PAT`.

  This is necessary to push changes that include modifications to workflow files, which `GITHUB_TOKEN` cannot do due to lack of `workflow` permission.

ACKs for top commit:
  real-or-random:
    ACK 3a18afd5ff

Tree-SHA512: f0c786a3d769dbeab339f8687af836d2e576b778f4c6ddb6b5dd62e993ba6d8d8c427a2cd60d197283a896e415d4eea998ebb6356ee4424534cb934fac6c72ee

.github/workflows/sync.yml

@@ -32,7 +32,7 @@ jobs:
       - name: Fetch upstream & generate branch name & check for new commits
         id: check_commits
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.SYNC_PAT }}
         run: |
           gh repo set-default ${{ github.repository }}  # Set the default repo to the origin repository
           git remote add upstream ${{ env.UPSTREAM }}
@@ -66,7 +66,7 @@ jobs:
         id: branch_pr_metadata
         if: steps.check_commits.outputs.skip == 'false'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.SYNC_PAT }}
         run: |
           # Call the sync script to generate PR title and body
           ./contrib/sync-upstream.sh -b ${{ env.ORIGIN_BRANCH }} "$SYNC_BRANCH"
@@ -75,7 +75,7 @@ jobs:
         id: push_branch
         if: steps.check_commits.outputs.skip == 'false'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.SYNC_PAT }}
         run: |
           echo "Creating sync branch: $SYNC_BRANCH"
           git checkout upstream/${{ env.UPSTREAM_BRANCH }}
@@ -86,7 +86,7 @@ jobs:
         id: create_pr
         if: steps.check_commits.outputs.skip == 'false'
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.SYNC_PAT }}
         run: |
           # Execute the generated PR creation script
           ./contrib/gh-pr-create.sh