fix: grant FilOzzy admin access for security reports

[rjan90]

Summary

• Grant FilOzzy admin access on the FilOzone repos covered by the FOC security reporting policy.
• Move FilOzzy from lower repository permissions to admin where it was already present.

Why

Private vulnerability report notifications are sent to repository administrators/security managers with the right notification settings. FilOzzy routes to the shared infra inbox, giving us a shared fallback notification path for reports.

Ref: FilOzone/tpm-utils#16 (comment)

[github-actions]

Before merge, verify that all the following plans are correct. After merge, Apply will regenerate the plans from the merged commit and continue only if they match.

Terraform plans

FilOzone

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
-/+ destroy and then create replacement

Terraform will perform the following actions:

  # github_repository_collaborator.this["dealbot:filozzy"] must be replaced
-/+ resource "github_repository_collaborator" "this" {
      ~ id                          = "dealbot:FilOzzy" -> (known after apply)
      + invitation_id               = (known after apply)
      ~ permission                  = "push" -> "admin" # forces replacement
      + permission_diff_suppression = false
        # (2 unchanged attributes hidden)
    }

  # github_repository_collaborator.this["filecoin-pay:filozzy"] will be created
  + resource "github_repository_collaborator" "this" {
      + id                          = (known after apply)
      + invitation_id               = (known after apply)
      + permission                  = "admin"
      + permission_diff_suppression = false
      + repository                  = "filecoin-pay"
      + username                    = "FilOzzy"
    }

  # github_repository_collaborator.this["filecoin-services:filozzy"] will be created
  + resource "github_repository_collaborator" "this" {
      + id                          = (known after apply)
      + invitation_id               = (known after apply)
      + permission                  = "admin"
      + permission_diff_suppression = false
      + repository                  = "filecoin-services"
      + username                    = "FilOzzy"
    }

  # github_repository_collaborator.this["pdp:filozzy"] will be created
  + resource "github_repository_collaborator" "this" {
      + id                          = (known after apply)
      + invitation_id               = (known after apply)
      + permission                  = "admin"
      + permission_diff_suppression = false
      + repository                  = "pdp"
      + username                    = "FilOzzy"
    }

  # github_repository_collaborator.this["sessionkeyregistry:filozzy"] will be created
  + resource "github_repository_collaborator" "this" {
      + id                          = (known after apply)
      + invitation_id               = (known after apply)
      + permission                  = "admin"
      + permission_diff_suppression = false
      + repository                  = "SessionKeyRegistry"
      + username                    = "FilOzzy"
    }

  # github_repository_collaborator.this["synapse-sdk:filozzy"] must be replaced
-/+ resource "github_repository_collaborator" "this" {
      ~ id                          = "synapse-sdk:FilOzzy" -> (known after apply)
      + invitation_id               = (known after apply)
      ~ permission                  = "push" -> "admin" # forces replacement
      + permission_diff_suppression = false
        # (2 unchanged attributes hidden)
    }

Plan: 6 to add, 0 to change, 2 to destroy.

[github-actions]

The following access changes will be introduced as a result of applying the plan:

Access Changes

User filozzy:
  - will have the permission to dealbot change from push to admin
  - will have the permission to synapse-sdk change from push to admin
  - will gain admin permission to filecoin-pay
  - will gain admin permission to filecoin-services
  - will gain admin permission to pdp
  - will gain admin permission to sessionkeyregistry