GH: permissions

Current https://cml.dev/doc/self-hosted-runners?tab=GitHub#personal-access-token only covers "[classic](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-personal-access-token-classic)" tokens.

Missing:

- [ ] [creating GH fine-grained tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token#creating-a-fine-grained-personal-access-token)
+ [ ] [permissions required](https://docs.github.com/en/rest/overview/permissions-required-for-fine-grained-personal-access-tokens) for each CML command
- [ ] [workflow `permissions`](https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions) required for each CML command
- [ ] move this PAT guide somewhere more general (e.g. https://cml.dev/doc/usage) because it's not just for (self-hosted) `runner`

related: #284 & autogen demo repos

know issues:

```
401 HttpError: Personal access tokens with fine grained access do not support the GraphQL API
```