ci: correlate codegen validation runs

[ryanduguid]

Summary

• ask the workflow-dispatch API to return the exact codegen run it created
• wait for that run ID instead of selecting the repository's latest run after a fixed sleep
• remove the unused checkout and broad write permissions
• pin the GitHub App token action and replace the extra third-party wait action with GitHub CLI
• cancel superseded validation for the same pull request and bound total runtime

Why

Concurrent pull requests can currently select each other's codegen runs, which can report the wrong validation result. GitHub's dispatch API now returns the created run ID when return_run_details is enabled.

Validation

• actionlint .github/workflows/pr-validation.yml
• git diff --check

The private codegen repository and its application credentials are intentionally not accessible to this contribution. Maintainers should confirm one real dispatch in the trusted upstream environment before taking this pull request out of draft.

[ryanduguid]

Current status across #833–#837 appears cross-correlated: all five public PR Validation jobs selected the same private xero-internal/xeroapi-sdk-codegen run, 31792288728, which failed at Build SDK. I cannot access that private job log or approve the pending fork workflows. Because validation runs from the upstream pull_request_target workflow, this PR cannot bootstrap its own correlation fix. Could a maintainer please inspect private run 31792288728, approve the PR Linting and OpenAPI Spec Diff runs, apply or merge this correlation fix to master, and then rerun #833–#837 after the base fix (preferably serially)? I have not changed or retriggered the five branches because the public evidence does not tie the shared downstream failure to their individual diffs.