docs: add GitHub MCP setup for Actions

[sylvesterkaczmarek]

Summary

Document how to configure GitHub's MCP server for codex-action, including a copyable workflow example that uses the job's GitHub token with explicit permissions.

Fixes #60.

Problem

The README currently mentions MCP only as a general suggestion. It does not show how an Actions user should:

• configure an MCP server in the Codex home used by the action;
• pass GitHub authentication to that server;
• keep the OpenAI API key separate from the GitHub credential;
• grant the workflow enough GitHub permissions for MCP write operations.

That leaves users asking how to give Codex GitHub MCP access from the Action without a supported example to follow.

Documentation added

docs/github-mcp.md provides a complete remote-server setup using the current Codex MCP config shape:

[mcp_servers.github]
url = "https://api.githubcopilot.com/mcp/"
bearer_token_env_var = "GITHUB_TOKEN"
required = true

The workflow exposes github.token only as GITHUB_TOKEN for the Codex step and passes the same prepared home through codex-home.

The guide also explains:

• the distinct roles of openai-api-key and the GitHub credential;
• least-privilege workflow permissions;
• replacing github.token with a dedicated secret when needed;
• local-vs-remote GitHub MCP options;
• common initialization and permission troubleshooting.

examples/github-mcp.yml contains the same pattern as a standalone workflow example.

Verification

The example is based on the current public interfaces of both projects:

• Codex supports remote MCP configuration through mcp_servers.<name>.url and bearer_token_env_var;
• GitHub's official MCP server documents https://api.githubcopilot.com/mcp/ as its remote endpoint and supports token authentication;
• codex-action already preserves caller-provided Codex configuration when adding its Responses proxy settings.

No runtime code, action inputs, generated bundle, or security behavior changes.

Scope

Documentation and example workflow only. This PR does not install a local MCP process, add new action inputs, broaden GITHUB_TOKEN permissions automatically, or change the action's write-access guard.