Investigate how can make pages auth work with only `read_api` scope

From https://gitlab.com/gitlab-org/security/gitlab-pages/-/merge_requests/6#note_464150499:

Taking a step back here and I wanted to ask why do we need api scope for the token?

That's a good question, we should be fine with the read_api scope at least.

• Test if read_api is enough for pages auth
• If it's not enough, discuss with the security team if we can expose https://gitlab.com/gitlab-org/gitlab/-/blob/903ee8c0832f8fea8bb141601e71770c05d5b675/lib/api/projects.rb#L344 endpoint for the read_api scope
• Check if artifacts proxying also works with the read_api scope
• Fix the default in omnibus
• Fix the default in charts(if there's one)
• Ask product manager to write the post describing how to "harden" security by finding the pages app in admin panel and changing the scope.