Enable temporary images clean up

[pnpavlov]

Implement retention policy for container image uploaded from nvidia-installer repo. Use the GitHub workflow which reads the packages and list the version which is older than 30 days (https://github.com/gardenlinux/gardenlinux-nvidia-installer/blob/enh/add_retention_policy/.github/workflows/clean_up_old_packages.yml).

GitHub token from bot gives error (https://github.com/gardenlinux/gardenlinux-nvidia-installer/actions/runs/18373494003/job/52341988150). Likely related to this.

Goal: Now my Question is: Find a way to generate classic PAT and use this for this purpose instead of bot.

Limitation: Avoid using personal credentials or creating a technical user managed by the team.

[brdanin]

What I've already tried:

• Created a new GitHub App (gardenlinux-ghcr-cleanup-test) that has permissions to read/write packages published to the GitHub Package Platform
• Added the App to the repo
• Updated the action to support GitHub App Installation Access Tokens (using https://github.com/actions/create-github-app-token)

- name: Get GitHub App installation token
        id: app-token
        uses: actions/create-github-app-token@v2
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
- name: Delete old container images older than 30 days 
        env:
          EXPIRY-DAYS: 30
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
        // From here the code has been kept unchanged

This still does not work and results in the same error:
gh: Invalid argument. (HTTP 400)

Unfortunately it seems this is a hard limitation we can't really avoid. This comment sums it up pretty well:

I've kept the GitHub App for testing purposes but feel free to delete it again if we decide to go down a different route.

[SujanaSubr]

We need a Technical user to do the deletion in ghc registry.

• Next plan is to add it to a different OCI registry instead of deleting the old ones.
• Create a Technical user if possible