fix: restrict permissions for APM packages update workflow

[nookyo]

Summary

• reduce the APM update job's automatic GITHUB_TOKEN permission to contents: read
• use the automatic read-only token for checkout instead of exposing APM_UPDATE_TOKEN
• retain APM_UPDATE_TOKEN only for the wrapper action, which creates or updates the branch and pull request

Validation

• git diff --check
• reviewed the wrapper token flow: peter-evans/create-pull-request and auto-merge receive the explicit action token

Closes #479