Inaccurate functionality description #640

Hello. I believe that current action description has a mistake
Section "Enabling auto-merge" does not require a PAT, any developer/dependabot can mark PR "auto merge", no powerful token is needed.
Section "Auto-approving" is opposite - it does require a PAT, but documentation do not mention it

In overall these 2 examples build impression I can easily build a workflow that will mark PR for auto-merge and then approve it - so that once all checks are passed - such PR can be merged! But in reality is not that simple. Problem is for approval you do need a PAT, but where to store it? If store in repo secrets, then any developer can craft a custom workflow in a feature branch where they get access to this PAT

I think authors need to provide a more secure way or clearly mention this risk in a documenation