chore(ci): Add perms for PR labeler (#31738)

* chore(ci): Add perms for PR labeler

* chore(ci): Add perms for PR labeler

* chore(ci): Revert to pull_request_target for PR labeler

* chore(ci): Restrict perms in pr labeler, 'persist-credentials: false' in checkout step

.github/workflows/pr-labeler.yml

@@ -1,10 +1,11 @@
 name: Pull request labeler
 
 on:
-  pull_request:
-    types: [opened, synchronize]
-    branches:
-      - "main"
+  - pull_request_target
+
+permissions:
+  pull-requests: write
+  contents: read
 
 jobs:
   # Docs: https://github.com/actions/labeler
@@ -26,6 +27,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Label PR based on size
         uses: cbrgm/pr-size-labeler-action@main