Add PAT for Protected Branch Push Access (smithmicro#93)

- Use `persist-credentials: false`, "... otherwise, the token used is the GITHUB_TOKEN, instead of your personal access token" (from https://github.com/ad-m/github-push-action#readme)
- Always fetch latest `default` branch before publishing pre-release

.github/workflows/publish-prerelease.yml

@@ -17,6 +17,10 @@ jobs:
       contents: write
     steps:
       - uses: actions/checkout@v3
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+          ref: issue-93-gh-actions
       - uses: actions/setup-node@v3
         with:
           node-version: 16
@@ -63,4 +67,4 @@ jobs:
         uses: ad-m/github-push-action@master
         with:
           branch: master
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GHA_MAPBOXGLCIRCLE_GITHUB_TOKEN }}

.github/workflows/publish-release.yml

@@ -14,6 +14,7 @@ jobs:
     steps:
       - uses: actions/checkout@v3
         with:
+          persist-credentials: false
           fetch-depth: 0
           ref: master
       - uses: actions/setup-node@v3
@@ -62,4 +63,4 @@ jobs:
         uses: ad-m/github-push-action@master
         with:
           branch: master
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GHA_MAPBOXGLCIRCLE_GITHUB_TOKEN }}