feat: add per-permission-level repo exclusions to github-add-repo-permissions

[locus313]

Summary

Adds per-permission-level repository exclusion support to github-add-repo-permissions. Previously the script applied each configured permission level to every repo in the org (optionally prefix-filtered). Now each level can skip a specific set of repositories.

Changes

• Script — added five optional exclusion variables: REPO_ADMIN_EXCLUDE, REPO_MAINTAIN_EXCLUDE, REPO_PUSH_EXCLUDE, REPO_TRIAGE_EXCLUDE, REPO_PULL_EXCLUDE. Each is a space-separated list of exact repo names skipped for that permission level only. New is_excluded and apply_level helpers handle the logic and emit a Skipping <level> on <repo> (excluded) message.
• action.yml — exposed the five new variables as repo-*-exclude inputs with env mappings.
• README.md — documented the exclusion behavior and variables.
• Tests — added a "no permission level set" guard test plus two behavioral tests (excluded repo skipped for pull only; all repos applied when exclude empty), backed by a new endpoint-aware curl mock at tests/mock_curl_permissions.sh.

Motivation

Allows granting broad team access while carving out sensitive repositories from a specific level (e.g., exclude certain repos from a read-only/pull team) without splitting runs or maintaining separate configs.

Testing

• shellcheck clean on the modified script and new mock.
• bats tests/ — full suite passes (101 tests), including the 5 tests for this script.

Usage example

export REPO_PULL="external-auditors"
export REPO_PULL_EXCLUDE="secret-repo internal-tools"