[check-valid-credentials] support Fine-grained PATs

At the moment, check-valid-credentials relies on being able to know what permissions a token has by querying the `X-OAuth-scopes` field from the response header, but the Fine-Grained PATs (as of now) do not deploy these (see [this community discussion comment for updates](https://github.com/orgs/community/discussions/36441#discussioncomment-4838839))

One solution is to somehow detect if the token is a Fine-Grained PAT (e.g. by detecting if the text starts with `github_`) and then allowing them to pass through without checking permissions.

Start by locating the check-valid-credentials action and reading how it uses the X-OAuth-scopes response header to validate permissions. Compare that behavior with Fine-grained PATs, including tokens beginning with github_, and confirm that the chosen handling preserves existing credential checks while allowing supported tokens through.

Written by the indexing model from the issue text.