Use CI_ACCESS_TOKEN to create release PR

[bayandin]

Problem

If @github-actions creates release PR, the CI pipeline is not triggered (but we have release-notify.yml workflow that we expect to run on this event).
I suspect this happened because @github-actions is not a repository member.

Ref #5283 (comment)

Summary of changes

• Use CI_ACCESS_TOKEN to create PR
• Use gh instead of thomaseizinger/create-pull-request
• Restrict permissions for GITHUB_TOKEN to contents: write only (required for git push)

Checklist before requesting a review

• I have performed a self-review of my code.
• If it is a core feature, I have added thorough tests.
• Do we need to implement analytics? if so did you add the relevant metrics to the dashboard?
• If this PR requires public announcement, mark it with /release-notes label and add several sentences in this section.

Checklist before merging

• Do not forget to reformat commit message to not include the above checklist

[github-actions]

1644 tests run: 1570 passed, 0 failed, 74 skipped (full report)

---

Flaky tests (1)

Postgres 14

• test_download_remote_layers_api[local_fs]: release

Code coverage (full report)

• functions: 53.0% (7582 of 14310 functions)
• lines: 81.5% (44802 of 54966 lines)

---

_{The comment gets automatically updated with the latest test results
e06c406 at 2023-09-12T12:01:24.442Z :recycle:}