The v4.36.5 release failed at the Homebrew cask step with a 404 when pushing to DNSControl/homebrew-tap (https://github.com/DNSControl/dnscontrol/actions/runs/25402728783/job/74506128761). The HOMEBREW_TAP_TOKEN secret contained a classic PAT that was scoped to the old StackExchange organization and no longer had access after the migration to DNSControl. It has been rotated to a fine-grained PAT scoped to DNSControl/homebrew-tap only, with Contents read/write permission. The release has been re-run successfully: https://github.com/DNSControl/dnscontrol/actions/runs/25402728783/job/74759829144

This PR updates the rotation procedure in the docs to reflect the new token type, corrects the secret name from HOMEBREW_TAP_GITHUB_TOKEN to HOMEBREW_TAP_TOKEN, and adds the gh secret set command to the rotation steps.