Support remapping permission per workflow when it is ignored globally.

Closes #22
/cc @maethu