github: lower permission scope to public_repo