feat: add Octo STS trust policies for pharia-holmes and pharia-data-api

.github/chainguard/read-pharia-data-api.sts.yml

@@ -0,0 +1,12 @@
+# Trust policy to allow pharia-data-api repository to access data-go-packages
+# This enables pharia-data-api CI/CD workflows to download this private Go module
+
+# issuer never changes, is the GitHub token issuer
+issuer: https://token.actions.githubusercontent.com
+
+# Allow access from any ref (branch, tag, PR) in pharia-data-api repository
+subject_pattern: "repo:Aleph-Alpha/pharia-data-api:.*"
+
+# Grant read-only access to repository contents
+permissions:
+  contents: read

.github/chainguard/read-pharia-holmes.sts.yml

@@ -0,0 +1,12 @@
+# Trust policy to allow pharia-holmes repository to access data-go-packages
+# This enables pharia-holmes CI/CD workflows to download this private Go module
+
+# issuer never changes, is the GitHub token issuer
+issuer: https://token.actions.githubusercontent.com
+
+# Allow access from any ref (branch, tag, PR) in pharia-holmes repository
+subject_pattern: "repo:Aleph-Alpha/pharia-holmes:.*"
+
+# Grant read-only access to repository contents
+permissions:
+  contents: read