Test GitHub app permissions

[martincostello]

Testing secrets and permissions for #868.

[Copilot]

Pull request overview

This PR adds a test job to verify GitHub App permissions and secrets configuration for issue #868. The test job uses a GitHub App token to authenticate and display its permissions using the GitHub CLI.

Key Changes

• Added test-permissions job to the GHCR workflow to validate GitHub App token generation
• Configured job with contents: read and id-token: write permissions
• Implemented token retrieval using grafana/shared-workflows/actions/create-github-app-token action and permission validation using GitHub CLI

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The GitHub App token is being exposed in the workflow logs through the echo command. This creates a security vulnerability as tokens should never be printed to logs where they can be viewed by anyone with access to the workflow runs.

Consider using an environment variable instead:

- name: Show token permissions
  env:
    GH_TOKEN: ${{ steps.get-token.outputs.token }}
  run: |
    gh auth status

The gh CLI automatically uses the GH_TOKEN environment variable for authentication without needing to explicitly log in.

Suggested change

	run: |
	echo "${{ steps.get-token.outputs.token }}" | gh auth login --with-token
	env:
	GH_TOKEN: ${{ steps.get-token.outputs.token }}
	run: |

[martincostello]

Need to test in the right workflow name...