ci(cso): give the promote candidate step GH_TOKEN, and fail any workflow step that runs gh without a token

Promote run 39691485727 failed after its cso-runtime-release approval:
"Generate a fail-closed catalog candidate" calls gh api .../compare with no
GH_TOKEN, and gh on a hosted runner exits 4. test/workflow-gh-token.test.ts
scans every workflow step that invokes gh for a token in step, job or
workflow env.

.github/workflows/cso-runtime-promote.yml

@@ -64,6 +64,7 @@ jobs:
             --name cso-qualified-runtime-statements --dir qualification-evidence
       - name: Generate a fail-closed catalog candidate
         env:
+          GH_TOKEN: ${{ github.token }}
           CSO_QUALIFICATION_RUN: ${{ inputs.qualification_run_id }}
         run: |
           set -euo pipefail