Reduce permission for milestone GitHub Action

[marcotc]

This PR reduces the permission of the add-milestone-to-pull-requests GitHub Action to the minimum possible.

This is specially important on GitHub Actions that use the pull_request_target trigger, because it can run on pull requests by external contributors (which is what we want for this tagger action). More details about the dangers of pull_request_target here: https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
Despite these concerns, pull_request_target is the trigger we want because we do want external pull requests to trigger this Action and have permission to edit the milestone of a pull request (a write permission).

Notes

The only other action using, the pull-request-labeler, already has minimum permissions declared, thanks to well-documented default permissions by the Action author:

dd-trace-rb/.github/workflows/pull-request-labeler.yml

Lines 7 to 9 in 5e27525

	permissions:
	contents: read
	pull-requests: write

[codecov-commenter]

Codecov Report

Merging #3193 (8f9dfa7) into master (790e6b4) will increase coverage by 0.00%.
Report is 9 commits behind head on master.
The diff coverage is 100.00%.

@@           Coverage Diff           @@
##           master    #3193   +/-   ##
=======================================
  Coverage   98.21%   98.21%           
=======================================
  Files        1252     1252           
  Lines       71907    71937   +30     
  Branches     3329     3331    +2     
=======================================
+ Hits        70622    70654   +32     
+ Misses       1285     1283    -2     

Files	Coverage Δ
lib/datadog/appsec/processor.rb	94.18% <100.00%> (+0.28%)	⬆️
spec/datadog/appsec/processor_spec.rb	99.07% <100.00%> (+0.12%)	⬆️

... and 3 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[ivoanjo]

👍 LGTM. I took a look at the list of available permissions and it confirms (in a bit of a confusing way) that this is the right permission for the job.