Tighten pull_request_label workflow permissions (#2804)

.github/workflows/pull_request_label.yaml

diff --git a/.github/workflows/pull_request_label.yaml b/.github/workflows/pull_request_label.yaml
index 7cd6898..1aaeea8 100644
--- a/.github/workflows/pull_request_label.yaml
+++ b/.github/workflows/pull_request_label.yaml
@@ -5,10 +5,11 @@
 # https://github.com/actions/labeler.
 
 name: Pull Request Labeler
-permissions: read-all
+permissions: {}
 
 on:
-  pull_request_target
+  # zizmor: ignore[dangerous-triggers] - labels fork and Dependabot PRs; no PR code is checked out
+  pull_request_target:
 
 jobs:
   label: