ci: pin auto-approve caller to permissions: {} (#12)

Parity with the other repos — the caller job needs no GITHUB_TOKEN of its own
(the reusable workflow mints its own App token). Fixes CodeQL 'Workflow does
not contain permissions'.

Author: Aswinmcw

.github/workflows/auto-approve.yml

@@ -6,6 +6,10 @@ on:
   pull_request_target:
     types: [opened, reopened, ready_for_review, synchronize]
 
+# This caller job needs no token of its own — the reusable workflow mints its
+# own App token and uses the org PAT. Pin to none for least privilege.
+permissions: {}
+
 concurrency:
   group: auto-approve-${{ github.event.pull_request.number }}
   cancel-in-progress: true