Reduce workflow credential exposure

[moonbox3]

Motivation & Context

Workflow run logs currently expose configuration metadata that does not need to be public, and DevFlow depends on a separately managed user credential for Copilot requests. These values and credentials should be minimized while preserving the established authentication behavior and rollout controls.

Description & Review Guide

• What are the major changes? Read non-mode authentication configuration from environment secrets in all six affected workflows. Grant only the two DevFlow execution jobs copilot-requests: write and use their run-scoped GitHub token for Copilot authentication.
• What is the impact of these changes? GitHub masks the configuration inputs in workflow logs, and DevFlow no longer requires a separately rotated Copilot credential. The authentication rollout mode remains an environment variable.
• What do you want reviewers to focus on? Confirm that every affected workflow consistently uses the masked configuration context and that the Copilot permission is limited to the jobs that make Copilot requests.

Related Issue

Fixes #7269

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

Pull request overview

Updates GitHub automation workflows to reduce metadata exposure in run logs by sourcing non-mode GitHub App authentication configuration from masked secrets, while keeping the rollout/auth mode controlled via vars.GH_APP_AUTH_MODE as requested in #7269.

Changes:

• Replaced vars.GH_APP_* (non-mode auth config) with secrets.GH_APP_* across the affected workflows.
• Kept mode as vars.GH_APP_AUTH_MODE to preserve the existing rollout control mechanism.
• Applied the same masking approach consistently to both call sites in workflows that request tokens multiple times.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/stale-issue-pr-ping.yml	Switches GitHub App auth configuration inputs to secrets.* for masking in scheduled/manual stale ping automation.
.github/workflows/limit-community-prs.yml	Updates both token acquisition steps to use secrets.*, keeping mode in vars.* while masking other auth config.
.github/workflows/label-pr.yml	Uses secrets.* for GitHub App auth configuration in the PR labeling workflow (pull_request_target).
.github/workflows/label-issues.yml	Uses secrets.* for GitHub App auth configuration in the issue labeling workflow.
.github/workflows/issue-triage.yml	Uses secrets.* for GitHub App auth configuration in issue triage automation while keeping mode in vars.*.
.github/workflows/devflow-pr-review.yml	Uses secrets.* for GitHub App auth configuration in the PR review workflow while preserving existing mode control.