Full write permissions to all repos

[yarda]

I think it's unacceptable risk to give the app full R/W permissions to all repos including keys deployment just to report new license.

It was originally reported as #192 but closed later. Reporting again to keep it visible.

[bact]

This issue exists because there two paths of license submission:

1. Regular user - GitHub issue will be created
2. Collaborator of spdx/license-list-XML - GitHub PR will be created (fork repo + commit license XML + open PR) automatically for that user (see: makePullRequest, handle_pull_request, route src/app/urls.py:33)

The 2nd path requires public_repo write permission.

To remove the requirement for public_repo write permission, have to disable the 2nd path and let all collaborators use the 1st path.

[goneall]

Is there a way we can search the PR's in the license list XML repo to see if the collaborator feature is being used?

[bact]

Maybe not directly but we can probably look for "[Pull Request]" in the log?

The code put this prefix in several places

spdx-online-tools/src/app/utils.py

Line 132 in ed792e6

logger.error("[Pull Request] Error occured while getting ref of main branch, for {0} user. {1}".format(username, response.text))

Limitation is this will only occurs if there was something wrong.

[bact]

btw, related issue #204