Define Access Management Process for `opensafely-actions`

[nishtha-kalra]

Why are we doing this?

There is currently no clearly documented process for managing access to repositories in the opensafely-actions. It is unclear who owns access decisions, who can grant permissions, and what permission levels should be used.

Related Slack thread.
Slightly related playbook for opensafely organisation.

How will we know when it's done?

• A documented process exists for requesting and granting repository access.
• Repository ownership and responsibility for access decisions are defined.
• Guidance on appropriate permission levels is available.
• A corresponding playbook entry has been created.

What are we doing?

• Define ownership and responsibility for repository access within opensafely-actions.
• Document the process for requesting, approving, and granting access.
• Define guidance on repository permission levels and who should receive them.
• Add the process to the tech-support playbook.