Parse the ADDITIONAL_PERMISSIONS env var and send it as a JSON body in the OIDC token exchange request. Permissions are merged on top of the standard defaults (contents: write, pull_requests: write, issues: write).
