chore: Use a protected env for upgrade workflow

[lym953]

What does this PR do?

Make the dependency upgrade workflow upgrade.yml use an environment protected-main-env.

Motivation

Right now the secrets for the GitHub App (GH_APP_ID and GH_APP_PRIVATE_KEY) are repo secrets, which can be made more secure by changing to environment secrets following this guide: https://datadoghq.atlassian.net/wiki/spaces/SECENG/pages/3034155880/Guide+How+to+Secure+Your+GitHub+Repositories#Secret-management

Before this PR, I just created an environment protected-main-env that has the two secrets. After this PR is merged, I will remove the two repo secrets.

Testing Guidelines

To test after merging this PR because the workflow can only run on main.

Additional Notes

Types of Changes

• Bug fix
• New feature
• Breaking change
• Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

• This PR's description is comprehensive
• This PR contains breaking changes that are documented in the description
• This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
• This PR impacts documentation, and it has been updated (or a ticket has been logged)
• This PR's changes are covered by the automated tests
• This PR collects user input/sensitive content into Datadog

Jira: https://datadoghq.atlassian.net/browse/SVLS-6927

[lym953]

This file is generated. I modified .projenrc.js so these two lines can be added.

[lym953]

Nice! I triggered the workflow and it created #439.