Actions: Add warning/finding when using actions/create-github-app-token without permissions

**Description of the issue**
You can use https://github.com/actions/create-github-app-token to create an app installation token. Depending on the app, it can have broad permissions. Unfortunately, the action does not use `permissions-none` as default, but all the permissions of the app.

So CodeQL could warn when using this app without setting permissions.

Start by reviewing the actions/create-github-app-token action and how CodeQL analyzes GitHub Actions workflows. Define the warning's trigger and expected handling for workflows that omit permissions, then add coverage showing the finding for the relevant configuration.

Written by the indexing model from the issue text.