Document required permissions

[jsoref]

It's really helpful to document which permissions are required.

A good way to do this is with a sample workflow.

I ran into a repository that didn't know pull-requests: write was required...