ci: use actions-github-app-token

.github/workflows/labeler.yml

@@ -1,13 +1,22 @@
 name: "Pull Request Labeler"
-# https://github.com/actions/labeler
 
 on:
-  - pull_request_target
+  pull_request_target:
 
 jobs:
   triage:
     runs-on: ubuntu-22.04
+    timeout-minutes: 1
+    permissions: {}
     steps:
-    - uses: actions/labeler@v4
-      with:
-        repo-token: "${{ secrets.GH_PAT }}"
+      # https://github.com/peaceiris/actions-github-app-token
+      - uses: peaceiris/actions-github-app-token@v1.1.4
+        id: app
+        with:
+          app_id: ${{ secrets.GH_APP_ID }}
+          private_key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      # https://github.com/actions/labeler
+      - uses: actions/labeler@v4
+        with:
+          repo-token: "${{ steps.app.outputs.token }}"