fix(action): use token when fetching prs

Failing to do so causes it to fail when running in a private repo.

action.yml

@@ -42,17 +42,22 @@ runs:
       with:
         path: size-report.md
         name: ${{ inputs.artifact-name }}
-    - name: Upload Report
+    - name: Comment Report
       if: inputs.comment-on-pr == 'true'
       run: |
         set -eu
 
+        echo 'Determine head_ref'
         # For push & tag events it'll bet GITHUB_REF_NAME, for pull_request events it'll be GITHUB_HEAD_REF
         head_ref=${GITHUB_REF_NAME-$GITHUB_HEAD_REF}
 
-        pr_number=$(curl -X 'GET' \
+        echo "Get PR number for $head_ref"
+        prs=$(curl -X 'GET' \
                 "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/pulls?state=open&sort=recentupdate" \
-                -H 'accept: application/json' |
+                -H "Authorization: token $GITHUB_TOKEN" \
+                -H 'accept: application/json')
+
+        pr_number=$(echo "$prs" |
                 jq --arg head_ref "$head_ref" '.[] | select(.head.ref == $head_ref) | .number')
 
         # Protect against running before a PR is made or if it is triggered on the main branch