The doc should provide a minimum list of permissions for the GitHub Access Token

### Describe the feature or problem you’d like to solve

A clear and concise description of what the feature or problem is.

- The doc should provide a minimum list of permissions for the GitHub Access Token.
- The current documentation at https://github.com/github/github-mcp-server/blob/v1.7.0/docs/installation-guides/README.md mentions this,

> All installations with Personal Access Tokens (PAT) require: GitHub Personal Access Token (PAT): Create one here
>
> Regardless of which installation method you choose, follow these security guidelines:
>
> Limit Token Scope: Only grant necessary permissions to your GitHub PAT

- However, the list of permissions for `personal access token (classic)` is too long. I think the documentation needs to provide a minimum list of required permissions. See https://github.com/settings/tokens/new .
-
- Furthermore, the URL provided in the documentation is for creating the `personal access token (classic)`. I think the documentation should guide users to use the `fine-grained personal access token`, which only allows access to repositories within a specific scope, while the `personal access token (classic)` allows access to all unrelated repositories.
-

### Proposed solution

How will it benefit GitHub MCP Server and its users?

- This would obviously reduce the cognitive load.

### Example prompts or workflows (for tools/toolsets only)

If it's a new tool or improvement, share 3–5 example prompts or workflows it would enable. Just enough detail to show the value. Clear, valuable use cases are more likely to get approved.

- Null.

### Additional context

Add any other context like screenshots or mockups are helpful, if applicable.

- Null.

Start with docs/installation-guides/README.md and review the linked GitHub token creation pages to verify which permissions the server documentation currently assumes. Update the guidance to identify the minimum required permissions and direct users to the appropriate token flow; done means the setup instructions are specific and the least-privilege recommendation is clear.

Written by the indexing model from the issue text.