ci: migrate create-github-app-token from app-id to client-id (#192)

actions/create-github-app-token v3 deprecated the app-id input in favor
of client-id. The deprecation warning fires on every release workflow run
and the old input will stop working when Node.js 24 becomes the default
runner (June 16, 2026).

Migration:
- app-id (numeric, stored as secret) -> client-id (string, stored as variable)
- Added APP_CLIENT_ID repo variable with the attune-release-bot Client ID
- private-key remains unchanged as a secret

Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>

Author: SebTardif

.github/workflows/release.yaml

@@ -44,7 +44,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ secrets.APP_ID }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         id: release
@@ -390,7 +390,7 @@ jobs:
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
-          app-id: ${{ secrets.APP_ID }}
+          client-id: ${{ vars.APP_CLIENT_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: attune-io
           repositories: community-operators