add `models` as allowed permission by muzimuzhi · Pull Request #531 · rhysd/actionlint

See related GitHub blog 1 and docs 2. One concern: according to its doc, the models scope only supports values read and none, but not write. Similarly the id-token scope doesn't support value r...