[chore] restrict permissions on workflow (#11972)

This updates the pr update workflow to only the permissions needed.

Signed-off-by: Alex Boten <223565+codeboten@users.noreply.github.com>

.github/workflows/milestone-add-to-pr.yml

@@ -1,16 +1,20 @@
 # This action adds the "next release" milestone to a pull request
 # when it is merged
 
-name: 'Project: Add PR to Milestone'
+name: "Project: Add PR to Milestone"
 on:
   pull_request_target:
     types:
       - closed
 
+permissions: read-all
+
 jobs:
   update-pr:
     if: github.event.pull_request.merged
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with: