How to restrict the GITHUB_TOKEN to read-only permissions for contents and packages in a GitHub repository