[BUG] Dependabot PRs fail because the GitHub App token step cannot mint a token

[lawofcycles]

What is the bug?

The dependabot workflow (.github/workflows/dependabot_pr.yml) fails at the GitHub App token step with HttpError: A JSON web token could not be decoded, using the old tibdex/github-app-token action. Because no token is minted, the workflow cannot run updateSHAs or add the CHANGELOG entry and push them to the PR branch. As a result the verify-changelog check also fails with No update to CHANGELOG.md found. This blocks all Dependabot PRs.

How can one reproduce the bug?

1. Open any Dependabot PR, for example Bump commons-codec:commons-codec from 1.21.0 to 1.22.1 in /buildSrc #796.
2. Observe the dependabot check fails in about 6 seconds at the GitHub App token step.
3. Observe verify-changelog fails with No update to CHANGELOG.md found.

What is the expected behavior?

The workflow mints an App token, updates the license SHAs and the CHANGELOG, and pushes them to the PR branch so the checks pass.

What is your host/environment?

GitHub Actions. Affects all Dependabot PRs on main.

Do you have any screenshots?

Not applicable.

Do you have any additional context?

Not applicable.

[lawofcycles]

Update on this. #800 modernized the token step but it does not actually fix the failure. The real cause is the credentials. The repo level Dependabot secrets APP_ID and APP_PRIVATE_KEY were last updated 3 years ago and were invalid, and after removing them it became clear that opensearch-hadoop is not covered by any org level Dependabot secret.

Per opensearch-project/.github#547, broader access tokens will no longer be handed out for supply chain safety, so the GitHub App token approach cannot be restored. I initially misread this as a credentials provisioning gap when it is actually a policy change.

@Xtansia apologies for the review churn on #800, it turned out not to resolve the issue. I will rework this without a privileged token in line with the new policy.

[lawofcycles]

Follow up. #801 takes the policy compliant route. It removes the privileged token workflow, adds the skip-changelog label to the Dependabot configs so the changelog check passes without a commit, and license SHA updates for dependency bumps will be done manually by a maintainer running ./gradlew updateSHAs. This supersedes #800.