Fix AltStore source push rejected by branch protection

The update_altstore job pushed with the default GITHUB_TOKEN, which
cannot bypass the changes-through-PR ruleset on main. Check out with
REPO_TOKEN like the release and appcast jobs, and forward secrets to
the reusable workflow with secrets: inherit.

.github/workflows/update-altstore.yml

@@ -22,6 +22,9 @@ jobs:
       - uses: actions/checkout@v4
         with:
           ref: main
+          # Default GITHUB_TOKEN cannot bypass the "changes through PR only"
+          # branch ruleset; REPO_TOKEN can (same as the release workflow).
+          token: ${{ secrets.REPO_TOKEN }}
       - name: Get version info from release
         run: |
           TAG="${{ inputs.tag }}"