ci: use GitHub App token and signed commits for Homebrew and Scoop PRs

[developerkunal]

🔧 Changes

The Homebrew and Scoop jobs in release.yml now authenticate with a GitHub App token instead of GORELEASER_GITHUB_TOKEN, and the tap PR commits are signed.

• Each tap job generates a short-lived app token scoped to its own tap repo (contents: write, pull-requests: write) using actions/create-github-app-token, pinned to a commit SHA.
• The tap checkout and create-pull-request steps use that token.
• sign-commits: true is set on both PR steps, so GitHub signs the commits as the app. The GPG import steps and the committer input are removed.
• Requires the RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY secrets, with the app installed on auth0/homebrew-auth0-cli and auth0/scoop-auth0-cli. After this lands, GORELEASER_GITHUB_TOKEN, GPG_PRIVATE_KEY and GPG_PASSPHRASE can be removed from secrets.

The goreleaser job and release-beta.yml are unchanged.

📚 References

Follow-up to #1702.

🔬 Testing

Workflow change only. It will be exercised on the next stable tag, and the tap PR commits should show as Verified.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)