dev-cmd/tap-new: support private repos

[bayandin]

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them?
• Have you written new tests for your changes? Here's an example.
• Have you successfully run brew style with your changes locally?
• Have you successfully run brew typecheck with your changes locally?
• Have you successfully run brew tests with your changes locally?

---

This PR ensures that taps created with brew tap-new can be private (private repo + private packages) by listing all required permissions and setting the correct HOMEBREW_DOCKER_REGISTRY_TOKEN for bottles.

An alternative approach would be to add a --private flag to brew tap-new, so that additional permissions are added when it is set.
I'm happy to follow that approach if we decide it is better. An argument for the initially proposed approach is that even for public repos, it makes sense to restrict permissions only to the required resources.

[MikeMcQuaid]

Thanks @bayandin! One thought.

[MikeMcQuaid]

Looks great, thanks @bayandin!