Authorize report publishing and reviewer selection (astral-sh#29617)

Authorize report publishing and reviewer selection through
`.github/key-value-store.json` and `.github/secure-token-service.json`,
which the services read from `main`.

The four report workflows receive KV `read` and `write` access in
`pull-request` scope and STS `actions: read` and `pull_requests: write`
permissions for `pull_request` runs through the publisher on `main`.
`pull-request-reviewers.yml` receives KV `read` and `write` access in
`workflow` scope and STS `pull_requests: write` permission for
`workflow_dispatch` runs on `main`. All of these new grants require the
`automations` environment; none allow KV `delete`.

---------

Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>

Author: zanieb

.github/key-value-store.json

@@ -0,0 +1,45 @@
+{
+  "version": 1,
+  "rules": [
+    {
+      "on": ["workflow_dispatch"],
+      "caller_workflow": "pull-request-reviewers.yml",
+      "caller_ref": "refs/heads/main",
+      "environment": "automations",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/pull-request-reviewers.yml@refs/heads/main",
+      "permissions": { "workflow": ["read", "write"] }
+    },
+    {
+      "on": ["pull_request"],
+      "caller_workflow": "ci.yaml",
+      "caller_ref": "refs/pull/*/merge",
+      "environment": "automations",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "permissions": { "pull-request": ["read", "write"] }
+    },
+    {
+      "on": ["pull_request"],
+      "caller_workflow": "memory_report.yaml",
+      "caller_ref": "refs/pull/*/merge",
+      "environment": "automations",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "permissions": { "pull-request": ["read", "write"] }
+    },
+    {
+      "on": ["pull_request"],
+      "caller_workflow": "typing_conformance.yaml",
+      "caller_ref": "refs/pull/*/merge",
+      "environment": "automations",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "permissions": { "pull-request": ["read", "write"] }
+    },
+    {
+      "on": ["pull_request"],
+      "caller_workflow": "ty-ecosystem-analyzer.yaml",
+      "caller_ref": "refs/pull/*/merge",
+      "environment": "automations",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "permissions": { "pull-request": ["read", "write"] }
+    }
+  ]
+}

.github/secure-token-service.json

@@ -14,6 +14,55 @@
     }
   },
   "rules": [
+    {
+      "caller": "ruff",
+      "environment": "automations",
+      "caller_ref": "refs/heads/main",
+      "caller_workflow": "pull-request-reviewers.yml",
+      "on": ["workflow_dispatch"],
+      "permissions": { "pull_requests": "write" },
+      "target": "ruff"
+    },
+    {
+      "caller": "ruff",
+      "environment": "automations",
+      "caller_ref": "refs/pull/*/merge",
+      "caller_workflow": "ty-ecosystem-analyzer.yaml",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "on": ["pull_request"],
+      "permissions": { "actions": "read", "pull_requests": "write" },
+      "target": "ruff"
+    },
+    {
+      "caller": "ruff",
+      "environment": "automations",
+      "caller_ref": "refs/pull/*/merge",
+      "caller_workflow": "typing_conformance.yaml",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "on": ["pull_request"],
+      "permissions": { "actions": "read", "pull_requests": "write" },
+      "target": "ruff"
+    },
+    {
+      "caller": "ruff",
+      "environment": "automations",
+      "caller_ref": "refs/pull/*/merge",
+      "caller_workflow": "memory_report.yaml",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "on": ["pull_request"],
+      "permissions": { "actions": "read", "pull_requests": "write" },
+      "target": "ruff"
+    },
+    {
+      "caller": "ruff",
+      "environment": "automations",
+      "caller_ref": "refs/pull/*/merge",
+      "caller_workflow": "ci.yaml",
+      "reusable_workflow": "astral-sh/ruff/.github/workflows/publish-pull-request-report.yml@refs/heads/main",
+      "on": ["pull_request"],
+      "permissions": { "actions": "read", "pull_requests": "write" },
+      "target": "ruff"
+    },
     {
       "caller": "ruff",
       "environment": "automations",