Separate the credentials between read/write workflow artifacts

# Summary

# Use Cases

When would you use this?

More fine-grained access control for different teams. For example, some teams only need read access to workflow artifacts.

---

**Message from the maintainers**:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

The issue names no files, tests, or entry points. Start by clarifying the credential model and affected workflow-artifact access paths, then define how read-only and read/write teams are represented and validated; done means those access levels can be configured separately.

Written by the indexing model from the issue text.