Assign package only on factories that are not workflow

Also add scm_token to the token workflow factory.

src/api/spec/factories/tokens.rb

@@ -2,27 +2,34 @@
   factory :token do
     string { Faker::Lorem.characters(number: 32) }
     user
-    package
-    object_to_authorize { package }
 
     factory :service_token, class: 'Token::Service' do
+      package
+      object_to_authorize { package }
       type { 'Token::Service' }
     end
 
     factory :rss_token, class: 'Token::Rss' do
+      package
+      object_to_authorize { package }
       type { 'Token::Rss' }
     end
 
     factory :rebuild_token, class: 'Token::Rebuild' do
+      package
+      object_to_authorize { package }
       type { 'Token::Rebuild' }
     end
 
     factory :release_token, class: 'Token::Release' do
+      package
+      object_to_authorize { package }
       type { 'Token::Release' }
     end
 
     factory :workflow_token, class: 'Token::Workflow' do
       type { 'Token::Workflow' }
+      scm_token { Faker::Lorem.characters(number: 32) }
     end
   end
 end