README.md: update required scopes for oauth clients

[sebpretzer]

The guidance provided for the proper scopes for oauth clients is incomplete. It only includes the auth_keys scope, but any oauth client using this github action should also include all:read and devices:core. This follows the suggestion provided in #100 (comment).

I have attempted to follow the contributing guidelines found in commit-messages.md.

Note: The documentation on tailscale's website will need to be updated as well.

[mpminardi]

Hey @sebpretzer ! Were you seeing errors or failures when using the action without all:read and devices:core? auth_keys should be all that is needed to have the action minimally work with a node joining the target tailnet.

I've put up #183 which added a second OAuth client to our test suite with just the auth_keys scope specified and nodes created with this client are successfully joining our test tailnet.

[sebpretzer]

@mpminardi, you are absolutely correct, only auth_keys is needed.

I did not previously test it out, I had taken this comment at face value and tested out the 3 scopes, which obviously worked because auth_keys included.

I tested a newly scoped client with just auth_keys and things ran swimmingly. Apologies for the incorrect PR.

[mpminardi]

Glad to hear that things are working as expected! And no worries, thank you for opening the PR! Lead to uncovering that we weren't testing the new scopes in CI and to better regression testing coverage as a result 🙂