Scope GitHub App tokens to repo and minimum permissions

Each token-minting step now requests only the permissions the job
actually exercises and restricts the token to the current repository.

Plan:
  repositories: current repo
  permission-contents: read   (gh release list in Resolve-Version)
  permission-pull-requests: write (label/comment via Get-PSModuleSettings)

Publish-Module:
  repositories: current repo
  permission-contents: write  (gh release create/upload/delete)
  permission-pull-requests: write (gh pr comment)

Build-Module:
  repositories: current repo
  (no permission-* needed - only gh repo view which uses metadata:read,
   auto-granted to all GitHub App installations)

This limits blast radius: even if a compromised step obtained GH_TOKEN,
it could only act on the one repository and only with the declared
permission level, not on every repo in the installation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

.github/workflows/Build-Module.yml

@@ -48,6 +48,7 @@ jobs:
         with:
           app-id: ${{ secrets.GitHubAppClientId }}
           private-key: ${{ secrets.GitHubAppPrivateKey }}
+          repositories: ${{ github.event.repository.name }}
 
       - name: Build module
         uses: ./_wf/.github/actions/Build-PSModule

.github/workflows/Plan.yml

@@ -93,6 +93,9 @@ jobs:
         with:
           app-id: ${{ secrets.GitHubAppClientId }}
           private-key: ${{ secrets.GitHubAppPrivateKey }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: read
+          permission-pull-requests: write
 
       - name: Get-Settings
         uses: ./_wf/.github/actions/Get-PSModuleSettings

.github/workflows/Publish-Module.yml

@@ -49,6 +49,9 @@ jobs:
         with:
           app-id: ${{ secrets.GitHubAppClientId }}
           private-key: ${{ secrets.GitHubAppPrivateKey }}
+          repositories: ${{ github.event.repository.name }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Publish module
         if: fromJson(inputs.Settings).Publish.Module.Resolution.ReleaseType != 'None'