Use more restrictive permissions on the GitHub token. Signed-off-by: Tim 'mithro' Ansell <tansell@google.com>