GH: permissions

[casperdcl]

Current https://cml.dev/doc/self-hosted-runners?tab=GitHub#personal-access-token only covers "classic" tokens.

Missing:

• creating GH fine-grained tokens
  • permissions required for each CML command
• workflow permissions required for each CML command
• move this PAT guide somewhere more general (e.g. https://cml.dev/doc/usage) because it's not just for (self-hosted) runner

related: #284 & autogen demo repos

know issues:

401 HttpError: Personal access tokens with fine grained access do not support the GraphQL API