chore: set GH_TOKEN permissions on the job that only allow the semant…

…ic pull request job, that runs with pull_request_target, to have access to read the repository contents and pull-requests contents. The token does not have write permissions and has disabled read permissions on contexts that are not needed for the job (#28749)

.github/workflows/semantic-pull-request.yml

@@ -1,5 +1,21 @@
 name: "Semantic Pull Request"
-
+# @see https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs
+permissions:
+  actions: none
+  checks: none
+  # to check out & read the repository
+  contents: read
+  deployments: none
+  id-token: none
+  issues: none
+  discussions: none
+  packages: none
+  pages: none
+  # to read pull-request data, including commits/issues linked
+  pull-requests: read
+  repository-projects: none
+  security-events: none
+  statuses: none
 on:
   pull_request_target:
     types: