⚙️ Support optional PAT for rebase push to bypass branch rulesets

[aquarion]

Summary

• Adds an optional REBASE_TOKEN secret to the auto-rebase-dependabot workflow
• Uses it for the actions/checkout token so the subsequent push authenticates with the PAT
• Falls back to github.token if not provided, so other consumers are unaffected

Why

Repos with branch rulesets requiring status checks on dependabot-updates cannot be pushed to by github-actions[bot] after a rebase, because the rebased commits haven't had CI run against them yet. A PAT belonging to an admin (with ruleset bypass) unblocks the push while leaving the PR merge status check requirement intact.

Test plan

• Merge this first, then merge the consumer repo change that passes REBASE_TOKEN
• Add REBASE_TOKEN secret to the consumer repo
• Trigger the rebase workflow manually and confirm the push succeeds

🤖 Generated with Claude Code