Add a check that all repos for a project have scopes limited to those of the project

[djmitche]

So e.g., repos for project taskcluster should have scopes that are satisfied by ["assume:project-admin:taskcluster"].

[katherine95]

Is anyone working on this one?

[djmitche]

Not at the moment, no!

If you look at https://github.com/taskcluster/tc-admin/ you'll see that it supports "checks". There are no checks in community-tc-config yet, so a good first step here would be to get a single do-nothing check written and set up so that tc-admin check runs it.

Once that's in place, we can talk about the content of the check.