ci: keep the token out of the review job checkout and supply it to the push alone

No fixes have been suggested for this run group yet. See the Self-Healing CI docs for how fixes are suggested.