Scope gh-aw workflow secrets to GITHUB_TOKEN (#1475)

Add explicit github-token entries under tools.github and safe-outputs in

.github/workflows/java-interop-reviewer.md so the compiled lock file no

longer references the gh-aw fallback secret names GH_AW_GITHUB_TOKEN and

GH_AW_GITHUB_MCP_SERVER_TOKEN.

These names appear in the lock file purely as fallback chain entries that

are never set in this repo. A secret-audit report flags by name reference

in the YAML, so suppressing them satisfies the audit with no behavior change.

Before/after of the 'Secrets used:' header in the lock file:

  Before: COPILOT_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN,

          GH_AW_GITHUB_TOKEN, GITHUB_TOKEN

  After:  COPILOT_GITHUB_TOKEN, GITHUB_TOKEN

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: jonathanpeppers

external/Java.Interop/.github/workflows/java-interop-reviewer.lock.yml

@@ -22,11 +22,13 @@ network:
     - "microsoft.com"
 tools:
   github:
+    github-token: ${{ secrets.GITHUB_TOKEN }}
     toolsets: [pull_requests, repos]
     # Allow reading PR content from external/first-time contributors.
     # The /review command is gated to maintainers, so only trusted users can trigger it.
     min-integrity: none
 safe-outputs:
+  github-token: ${{ secrets.GITHUB_TOKEN }}
   create-pull-request-review-comment:
     max: 50
   submit-pull-request-review: