Limit requested GitHub access

* Don't include repo scope that gives write access
* Create Services team with pull access only