fix(ci): label PRs

Author: sthulb

.github/workflows/label_pr_on_title.yml

@@ -13,6 +13,7 @@ jobs:
   get_pr_details:
     permissions:
       id-token: write
+      contents: read
     # Guardrails to only ever run if PR recording workflow was indeed
     # run in a PR event and ran successfully
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
@@ -24,6 +25,7 @@ jobs:
       token: ${{ secrets.GITHUB_TOKEN }}
   label_pr:
     permissions:
+      contents: read
       id-token: write
     needs: get_pr_details
     runs-on: ubuntu-latest