Inspired by this PR.

This PR improves how we create the required check "All required checks succeeded" in the following ways:

• We now use a GitHub app to create the check instead of using the token provided by GitHub Actions. This allows us to create the check run with its own check suite instead of attaching it to the first GHA check suite, which changes when a pull request is closed and reopened, or when a new run attempt is made.
• A check is created and set as queued or in_progress when the corresponding workflow run's status changes. This is needed so that the check is reset when a new run attempt is made or a PR is reopened.
• Logging is improved.
• Start/Completion times are added.

The following tasks need to be completed before merging this PR:

• create and install a new GitHub app with the check:write permissions
• add its credentials to a new create-check environment that can only be accessed by the main/master branch

The following tasks need to be completed after merging this PR:

• update branch protection (or ruleset) to enforce the required check to originate from the new GitHub app

Fixes: #1248