📖 [Docs]: Secure GitHub App token handling patterns documented

[Marius Storhaug (MariusStorhaug)]

This adds a codified security standard for GitHub App installation token handling in workflows and composite-action usage so teams can apply least-privilege token patterns consistently.

Changed: Secure GitHub App token handling guidance for workflows and composite actions

The GitHub Actions standard now defines when to use github.token, PATs, and GitHub App installation tokens, and sets GitHub App tokens as the default write identity for workflow automation.

It now explicitly states that workflow permissions: only scopes github.token and does not scope app installation tokens, then defines the required controls for minted app tokens: always set repositories: and explicit permission-* inputs, never mint unscoped tokens, prefer step-level token injection, use GH_TOKEN for gh, and prefer environment-based token passing over named token inputs when actions support both.

Examples were added for minimum-scope token minting with actions/create-github-app-token pinned to a full SHA, safe step-level token injection, and safer token passing patterns that reduce debug-log exposure risk.

Technical Details

• Extended src/docs/Coding-Standards/GitHub-Actions.md with a new GitHub App token section placed after permission-baseline guidance.
• Added a token-type comparison table and prescriptive rules for installation-token scoping and injection boundaries.
• Aligned the new guidance with existing standards already present in this page for SHA pinning and explicit secret passing.

Related issues

• N/A (requested directly as cross-session documentation work)