Support optional repository and permission scoped installation tokens #583

Hi,

Firstly, thanks for building and maintaining this resource. It is genuinely useful to see GitHub App based authentication available within the Concourse ecosystem, especially as an alternative to machine users and long lived PATs.

I noticed that GitHub's installation token API supports optional repository and permission downscoping during token generation:

POST /app/installations/{id}/access_tokens

with optional request body fields such as:

{
  "repositories": ["repo-a"],
  "permissions": {
    "contents": "read"
  }
}

From reading the current README and examples, it looks like the resource currently requests installation tokens for users or orgs without exposing these optional scoping parameters.

Would support for optional repository and permission scoped installation token requests be something you would consider adding to the project, or potentially accepting as a future contribution?

Potentially something along the lines of optional source parameters such as:

source:
  appId: ((github-app-id))
  privateKey: ((github-app-private-key))
  org: my-org

  repositories:
    - repo-a
    - repo-b

  permissions:
    contents: read
    pull_requests: write

while keeping existing behaviour fully backwards compatible when omitted.

I think this could help support more least privilege oriented GitHub App usage patterns within Concourse pipelines.

Happy to help investigate further if this aligns with the project's direction.

Thanks again for the project.