Replace workflow-specific PATs with Neurobagel Bot app

[alyssadai]

See https://neurobagel.github.io/dev-docs/sections/Neurobagel%20PATs/ for our current list of PATs and more info on our bot.

To avoid having to renew user-generated PATs every few months, we can centralize the responsibility of some of our PATs with similar permissions to the Neurobagel Bot app.

PATs that can be replaced:

• NB_PROJECT_PAT, used in:

  • [x] https://github.com/neurobagel/workflows/blob/main/template_workflows/project_automation/add_iss2project.yml
  • [x] https://github.com/neurobagel/workflows/blob/main/.github/workflows/global_move_bot_pr_to_board.yml
  • [x] https://github.com/neurobagel/workflows/blob/main/.github/workflows/global_move_community_pr_to_board.yml

• NB_LAB_PAT, used in:

  • [x] https://github.com/neurobagel/workflows/blob/main/.github/workflows/global_move_bot_pr_to_board.yml
  • [x] https://github.com/neurobagel/workflows/blob/main/.github/workflows/global_move_community_pr_to_board.yml
  • [x] https://github.com/neurobagel/planning/blob/main/.github/workflows/label_apply_change.yml
  • [x] https://github.com/neurobagel/planning/blob/main/.github/workflows/label_sync.yml
  • [x] https://github.com/neurobagel/planning/blob/main/.github/workflows/manual_label_population_to_repos.yml

• double check if the global_move* wfs need two different tokens for different jobs

• probably need to add PROJECT permissions to Neurobagel Bot token

• update https://neurobagel.github.io/dev-docs/sections/Neurobagel%20PATs/#authenticating-using-the-neurobagel-bot-app with the new permissions added

[surchs]

For specification: figure out which workflows the bot can take off our hands