fix(actions): make Actions API work with repo admin permission (#40174)

The web route already uses "repo admin" for repo-level Actions
management.

* Fix #40173

---------

Co-authored-by: silverwind <me@silverwind.io>

tests/integration/api_actions_runner_test.go

@@ -10,7 +10,11 @@ import (
 	"testing"
 
 	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/organization"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unittest"
 	api "gitea.dev/modules/structs"
+	repo_service "gitea.dev/services/repository"
 	"gitea.dev/tests"
 
 	"github.com/stretchr/testify/assert"
@@ -371,6 +375,15 @@ func testActionsRunnerRepo(t *testing.T) {
 		MakeRequest(t, req, http.StatusNotFound)
 	})
 
+	t.Run("OrgAdminTeamMember", func(t *testing.T) {
+		adminTeam := unittest.AssertExistsAndLoadBean(t, &organization.Team{ID: 12})
+		orgRepo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 3})
+		require.NoError(t, repo_service.TeamAddRepository(t.Context(), adminTeam, orgRepo))
+		token := getUserToken(t, "user28", auth_model.AccessTokenScopeWriteRepository)
+		req := NewRequest(t, "POST", "/api/v1/repos/org3/repo3/actions/runners/registration-token").AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusOK)
+	})
+
 	t.Run("DeleteReadScopeForbidden", func(t *testing.T) {
 		userUsername := "user2"
 		token := getUserToken(t, userUsername, auth_model.AccessTokenScopeReadRepository)