fix(perm): allow workers with build tokens to access MustRead() for private visibility repos

[ecrupper]

Initial build token implementation failed to address repos with a private visibility status. Since the worker is not treated as a platform admin, it will fail the SCM check to verify read permissions.

This fix adds logic to allow workers to access MustRead endpoints from private repos so long as the build token is still accurate. I also added a related test.

I double checked the worker's flow and determined that it does not call endpoints behind MustWrite or MustAdmin, so I've decided to leave the build token logic out of those functions.

[codecov]

Codecov Report

Merging #776 (f5c171e) into main (32522bb) will increase coverage by 0.00%.
The diff coverage is 58.33%.

@@           Coverage Diff           @@
##             main     #776   +/-   ##
=======================================
  Coverage   54.87%   54.87%           
=======================================
  Files         244      244           
  Lines       16494    16506   +12     
=======================================
+ Hits         9051     9058    +7     
- Misses       7043     7048    +5     
  Partials      400      400           

Impacted Files	Coverage Δ
router/middleware/perm/perm.go	62.21% <58.33%> (-0.13%)	⬇️