Support self-hosted organisation runners without granting complete admin permissions

What would you like added?

I would like to have the ability to run runners for a whole organization without granting a token with organization admin rights to the controller.

A clear and concise description of what you want to happen.

Note: Feature requests to integrate vendor specific cloud tools (e.g. awscli, gcloud-sdk, azure-cli) will likely be rejected as the Runner image aims to be vendor agnostic.

Why is this needed?

It would allow minimizing potential consequences of token leakage and reduce security risks.
A clear and concise description of any alternative solutions or features you've considered.

Additional context

As far as I understood, it seems that right now it's not yet supported in runner itself - https://github.com/actions/runner/issues/443#issuecomment-663168938

Unfortunately, I haven't found a disccussion/issue for adding support to run organisation level runners without granting an admin token.

Add any other context or screenshots about the feature request here.

Start by reviewing the linked GitHub Actions Runner issue #443 and the controller's existing organization-runner authentication flow. Determine whether upstream supports this permission model; done means organization-level self-hosted runners work without giving the controller organization-admin credentials, with the security behavior documented and tested.