Tighten pull_request_label workflow permissions (#383)

.github/workflows/pull_request_label.yml

diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml
index b3b9fa7..b620bd0 100644
--- a/.github/workflows/pull_request_label.yml
+++ b/.github/workflows/pull_request_label.yml
@@ -5,10 +5,11 @@
 # https://github.com/actions/labeler.
 
 name: Pull Request Labeler
-permissions: read-all
+permissions: {}
 
 on:
-  pull_request_target
+  # zizmor: ignore[dangerous-triggers] - labels fork and Dependabot PRs; no PR code is checked out
+  pull_request_target:
 
 jobs:
   label: