More GitHub token permissions in Depot CI

Depot CI now supports the security-events and issues permission scopes on the built-in GITHUB_TOKEN.

The new scopes support workflows such as CodeQL uploads and issue maintenance without requiring a separate GitHub token.

Declare the permissions your workflow needs in its permissions: block. For example, an issue maintenance workflow can request:

permissions:
  contents: read
  issues: write

For CodeQL uploads, request security-events: write. See GitHub token permissions in Depot CI for compatibility details.