Add scoped tokens

[rvermeulen]

This PR introduces scoped tokens that allow you to reduce the scope of a token generated by a GitHub App

This has a few benefits such as making explicit what scopes you want to use and reduce the impact if a token leaks (when its scope is reduced).

It doesn't protect against malicious code that receives the token in the same workflow, because that code can directly access the private key used to generate the code.

Perhaps an additional explicit revoking Action could be useful here where a scoped token is generated by a job associated with an environment that has access to the private key, passes that token to a job that uses it and that job revokes the token after use using that revoking Action.

[gr2m]

please see #3, this is not the way we want to implement this feature. We started work towards what we want to do at #168