Support repository-scoped application tokens

[ikhoon]

Background

#1342 introduces public repositories and a creation-time allowGuestAccess option for application
tokens. The option is coarse: a token can either read every public repository or none of them.
When a team issues a token to an external consumer so that it can read a single repository, the
token should not be able to roam any other repository — including public ones.

Proposal

• Issue a token scoped to a single repository: the scope (project/repo + a RepositoryRole) is
  fixed at creation time.
• Outside its scope the token has no access at all; it is excluded even from the guest fallback,
  so it cannot read public repositories either.
• A repository ADMIN can issue and revoke tokens scoped to their repository without being a
  system administrator.
• Project-wide scope is intentionally not supported.

Notes

• Limits the blast radius of a leaked token to the scoped repository.
• Lifecycle to decide: listing/revoking scoped tokens in the repository settings, and cleanup when
  the repository is removed.
• Related: Provide a way to create/change to private repositories #622, Prohibit application tokens from accessing repositories with GUEST permission #1093, Support public repositories and creation-time guest access for app identities #1342