fix: cleanup go-libp2p-relay-daemon permissions

[aschmahmann]

IIUC by default most repos are supposed to look like:

• web3-bot gets push
• w3dt-stewards gets admin (maybe Admin gets admin too, or maybe that group is no longer required)
• Repos-Go (for Go repos) gets push

Probably with some other defaults we can't set in here like:

• master/main is protected and requires an approval to merge
• nobody gets to tag since that's done by CI

Looked at this repo since I was tagged by @hsanjuan and noticed #32 (which might be fine, but this change should probably happen either way)

[github-actions]

Before merge, verify that all the following plans are correct. They will be applied as-is after the merge.

Terraform plans

libp2p

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
  ~ update in-place
  - destroy

Terraform will perform the following actions:

  # github_repository_collaborator.this["go-libp2p-relay-daemon:marten-seemann"] will be destroyed
  # (because key ["go-libp2p-relay-daemon:marten-seemann"] is not in for_each map)
  - resource "github_repository_collaborator" "this" {
      - id         = "go-libp2p-relay-daemon:marten-seemann" -> null
      - permission = "admin" -> null
      - repository = "go-libp2p-relay-daemon" -> null
      - username   = "marten-seemann" -> null
    }

  # github_repository_collaborator.this["go-libp2p-relay-daemon:vyzo"] will be destroyed
  # (because key ["go-libp2p-relay-daemon:vyzo"] is not in for_each map)
  - resource "github_repository_collaborator" "this" {
      - id         = "go-libp2p-relay-daemon:vyzo" -> null
      - permission = "push" -> null
      - repository = "go-libp2p-relay-daemon" -> null
      - username   = "vyzo" -> null
    }

  # github_team_repository.this["Repos - Go:go-libp2p-relay-daemon"] will be created
  + resource "github_team_repository" "this" {
      + etag       = (known after apply)
      + id         = (known after apply)
      + permission = "push"
      + repository = "go-libp2p-relay-daemon"
      + team_id    = "2100801"
    }

  # github_team_repository.this["w3dt-stewards:go-libp2p-relay-daemon"] will be updated in-place
  ~ resource "github_team_repository" "this" {
        id         = "4657013:go-libp2p-relay-daemon"
      ~ permission = "push" -> "admin"
        # (3 unchanged attributes hidden)
    }

Plan: 1 to add, 1 to change, 2 to destroy.

[galargh]

Probably with some other defaults we can't set in here like:

• master/main is protected and requires an approval to merge
• nobody gets to tag since that's done by CI

We can control branch protection rules through this repo, see https://github.com/libp2p/github-mgmt/blob/master/github/libp2p.yml#L156-L158 for example. Right now, we're only tacking existence of branch protection rules but we can manage their settings too.

With tags, unfortunately, the story is not so great just yet because 1) admins can always create tags no matter what protections are set, 2) it is not possible to exempt the default token (that's what we use pretty much everywhere) from tag protection rules.