The webhook doesn't use down-scoped tokens

[mattmoor]

The webhook should be down-scoping tokens similar to the other paths like this:

app/pkg/octosts/octosts.go

Lines 264 to 272 in 8f1603b

	atr := ghinstallation.NewFromAppsTransport(s.atr, install)
	// We only need to read from the repository, so create that token to fetch
	// the trust policy.
	atr.InstallationTokenOptions = &github.InstallationTokenOptions{
	Repositories: []string{trustPolicyKey.repo},
	Permissions: &github.InstallationPermissions{
	Contents: ptr("read"),
	},
	}

It has several places it does something like this:

app/pkg/webhook/webhook.go

Line 221 in 8f1603b

Transport: ghinstallation.NewFromAppsTransport(e.Transport, installationID),

cc @wlynch @cpanato