chore: disable fine-grained github_token permissions

[tobybellwood]

so...

If we set the fine-grained permissions block (needed to attest images), the GITHUB_TOKEN no longer has the permissions to access organisation-scoped secrets (such as the docker hub credentials shared by all repos) - clue was at https://github.com/orgs/community/discussions/12424

Will keep looking at what we can do to access both organisation-scoped secrets and the attest permissions.

[smlx]

I think the issue might be dependabot specific. I'm looking into what the fix might be.
dependabot/dependabot-core#3253

[tobybellwood]

@smlx - ha, push and comment at the same time - looks like we just need write-all explicitly set as the permission to allow organization secret and id-token access

[smlx]

I don't think that's the reason it works now. If you re-add the permissions block and push again I think it will build just as it did in my original PR.

[smlx]

Ah, dependabot has its own secret store: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/configuring-access-to-private-registries-for-dependabot#about-encrypted-secrets-for-dependabot

[tobybellwood]

ugh - of course it does 🤦 I'll close this, as I've now added the same vars to dependabot org-scope.