sec(sts): retire RELEASE_BOT_TOKEN

Use STS instead

Author: aviadhahami

.github/chainguard/releaser.sts.yaml

@@ -0,0 +1,6 @@
+issuer: https://token.actions.githubusercontent.com
+subject_pattern: "^repo:odigos-io/simple-trace-db:ref:refs/heads/main$"
+
+permissions:
+  contents: write
+  pull_requests: write

.github/workflows/release-please.yml

@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
   pull-requests: write
 
 jobs:
@@ -20,8 +20,15 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Get release token
+        uses: odigos-io/ci-core/sts@main
+        id: release-token
+        with:
+          pairs: |
+            odigos-io/simple-trace-db:releaser
+
       - name: Create or Update Release PR
         uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{ secrets.RELEASE_BOT_TOKEN }}
+          token: ${{ steps.release-token.outputs.GH_TOKEN }}