fix(ci): use PAT for checkout to bypass branch protection (#34)

The manifest bump step pushes directly to main, which the default
GITHUB_TOKEN cannot do under the current ruleset. Use the org-level
GH_PERSONAL_ACCESS_TOKEN instead so the push identity has bypass
permission.

Signed-off-by: Ben <ben@armosec.io>

Author: slashben

.github/workflows/pr-merged.yaml

@@ -26,6 +26,7 @@ jobs:
             - uses: actions/checkout@v4
               with:
                   fetch-depth: 0
+                  token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
 
             - uses: actions/setup-go@v5
               with: