Fix AltStore source push rejected by branch protection

The update_altstore job pushed with the default GITHUB_TOKEN, which
cannot bypass the changes-through-PR ruleset on main. Check out with
REPO_TOKEN like the release and appcast jobs, and forward secrets to
the reusable workflow with secrets: inherit.

.github/workflows/release.yml

@@ -349,5 +349,6 @@ jobs:
     if: ${{ inputs.build_ios && success() }}
     needs: [release]
     uses: ./.github/workflows/update-altstore.yml
+    secrets: inherit
     with:
       tag: ${{ needs.release.outputs.tag }}

.github/workflows/update-altstore.yml

@@ -22,6 +22,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: main
+          # Default GITHUB_TOKEN cannot bypass the "changes through PR only"
+          # branch ruleset; REPO_TOKEN can (same as the release workflow).
+          token: ${{ secrets.REPO_TOKEN }}
       - name: Get version info from release
         run: |
           TAG="${{ inputs.tag }}"