[TEC-629] GitHub PAT permissions docs re-worked

[abhijna]

This PR updates the GitHub permissions docs so PAT users (including orgs still on classic tokens) can see what scopes and roles they need.

• Added a full GitHub PAT reference on SCM permissions: fine-grained vs classic, account/role requirements, Connect/Test validation, code access, and Autofix
• Expanded Grant code access with separate fine-grained and classic setup steps, and pointed scope questions back to SCM permissions so we don’t duplicate the matrix

Reorg

• Clarified the split: SCM permissions = what you need; Grant code access = how to configure it
• Swapped nav order so permissions comes before grant code access
• Put GitHub App and PAT under tabs (App first, as preferred)
• Explained public vs private Semgrep GitHub Apps before listing either app’s permissions
• Moved the Autofix GitHub API deep dive under Private GitHub App permissions, since it was never really general
• Autofix docs: Added a Next steps section for setup pages so the permissions page stays a reference

Review focus: Are the classic vs fine-grained scopes right for connection validation, and does the public/private App + PAT layout make sense?

• A subject matter expert reviews the content

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
semgrep-docs	🟢 Ready	View Preview	Sep 14, 2026, 6:09 PM

[armchairlinguist]

This definitely needs some refinement - while I've flagged a few things I noticed, I would highly recommend checking this with an SCM SME from the platform team.

[abhijna]

@armchairlinguist I checked with Zach and made changes accordingly. Summary:

• If you have both a PAT and an app configured, the app takes precedence.
• A PAT can actually be used instead of a private GitHub App for SMS!
• You do not need Contents: Read and write for Semgrep to leave PR comments. You only need Pull requests: Read and write.

[armchairlinguist]

Mostly just minor comments, some of which are opinion-y rather than important :)