fix(go-autoupdate): fall back to github.token when HOMEBREW_TAP_TOKEN is unset

create-pull-request and the gh pr merge step both hard-required HOMEBREW_TAP_TOKEN,
so any consumer repo without that secret got 'Input token not supplied' and the
whole Autoupdate run failed. A same-repo PR needs only the caller's
contents/pull-requests write; fall back to the auto-provisioned github.token.
Consumers that do set the tap token keep current behavior.

.github/workflows/go-autoupdate.yaml

@@ -67,7 +67,7 @@ jobs:
         if: steps.changes.outputs.changes_detected == 'true'
         uses: peter-evans/create-pull-request@v8
         with:
-          token: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN || github.token }}
           commit-message: "Update go.mod and go.sum"
           title: "Update Go dependencies"
           body: |
@@ -82,4 +82,4 @@ jobs:
         if: steps.create-pr.outputs.pull-request-number
         run: gh pr merge --squash --delete-branch --admin "${{ steps.create-pr.outputs.pull-request-number }}"
         env:
-          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          GH_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN || github.token }}