ci(sync): replace branch-protection-bot with github-script

.github/workflows/sync.yaml

@@ -121,24 +121,40 @@ jobs:
       # We want to prevent the "include administrators" branch protection from blocking the push,
       # but it should be usually there to avoid accidental pushes to main.
       - name: Temporarily disable "include administrators" branch protection
-        if: ${{ github.ref == 'refs/heads/main' }}
+        if: always() && github.ref == 'refs/heads/main'
         id: disable_include_admins
-        uses: benjefferies/branch-protection-bot@v1.1.2
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         with:
-          access_token: ${{ secrets.REPO_PAT }}
-          branch: main
-          enforce_admins: false
+          github-token: ${{ secrets.REPO_PAT }}
+          script: |
+            const params = {
+              owner: 'cloudnative-pg',
+              repo: 'api',
+              branch: 'main',
+            };
+            const { data } = await github.rest.repos.getAdminBranchProtection(params);
+            core.setOutput('initial_status', data.enabled);
+            if (data.enabled) {
+              await github.rest.repos.deleteAdminBranchProtection(params);
+            }
 
       - name: Push synced commits
         run: git push origin "HEAD:${GITHUB_REF_NAME}"
 
-      - name: Enable "include administrators" branch protection
-        uses: benjefferies/branch-protection-bot@v1.1.2
-        if: ${{ always() && github.ref == 'refs/heads/main' }}
+      - name: Restore "include administrators" branch protection
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        if: |
+          always() &&
+          github.ref == 'refs/heads/main' &&
+          steps.disable_include_admins.outputs.initial_status == 'true'
         with:
-          access_token: ${{ secrets.REPO_PAT }}
-          branch: main
-          enforce_admins: ${{ steps.disable_include_admins.outputs.initial_status }}
+          github-token: ${{ secrets.REPO_PAT }}
+          script: |
+            await github.rest.repos.setAdminBranchProtection({
+              owner: 'cloudnative-pg',
+              repo: 'api',
+              branch: 'main',
+            });
 
       # When the sync is triggered by a release, the cloudnative-pg release-tag
       # workflow passes the release tag in the dispatch payload. Tag the freshly