feat: Add optional planning-token to Add Team Label action

[Mrtenz]

With token-exchange-service we can only target a single repository per token, meaning we can't generate a token that can access both MetaMask/metamask-mobile (to add the label) and MetaMask/metamask-planning (to read the topology file). To support this, we need to use two separate tokens.

---

Note

Low Risk
Small CI composite-action input change; backward compatible when planning-token is omitted.

Overview
Adds an optional planning-token input to the Add Team Label composite action so workflows can use two GitHub tokens when a single token cannot reach both repos (e.g. token-exchange-service scoped to one repository).

The Get team label step now authenticates with planning-token when provided, otherwise falls back to team-label-token, for the gh api call that reads topology.json from MetaMask/metamask-planning. The Add team label step is unchanged and still uses team-label-token only to apply the label on the PR.

Callers that already have one token with access to both planning and the target repo do not need to pass the new input.

^{Reviewed by Cursor Bugbot for commit f4a22bc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 02cfa9e. Configure here.}

[FrederikBolding]

Is this ever gonna use the team-label-token?

[Mrtenz]

Yeah, if planning-token (optional) is not specified.

[FrederikBolding]

Yeah, I mean in practice, where would this be used versus the planning-token?

[Mrtenz]

It likely wouldn't, but we can't really fix that without a breaking change, and I want to avoid that (since it means bumping github-tools to v2 as a whole).

[FrederikBolding]

Then I don't follow the change, can't we just pass in the planning token in the team-label-token parameter?

[FrederikBolding]

Oh, for the job below it 🤔

[Mrtenz]

Yeah, token-exchange-service doesn't let us create a single token that works in both jobs.