Indicate what permissions are required for the GitHub API token.

[hainesr]

There are lots of options, mostly fairly scary. I restricted mine to repo-level operations but it would be good to have this documented somewhere.