test(i18n): use machine account PAT for all git interaction

.github/workflows/sync_translations.yml

@@ -3,20 +3,19 @@ name: Sync Translations
 on:
   workflow_dispatch:
 
-permissions:
-  contents: read
+# We use a machine account PAT from secrets so workflows are triggered
+# the default token is not needed and should be fully restricted
+permissions: {}
 
 jobs:
   sync_translations:
-    permissions:
-      contents: write  # for Git to git push
-      pull-requests: write # to create the PR with changes
     name: 'Sync Translations with Crowdin'
     timeout-minutes: 20
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
+          token: ${{ secrets.MACHINE_ACCOUNT_PAT }}
           ref: 'main'
           fetch-depth: 0