ci: declare empty permissions for do-not-merge label check

This workflow only checks the PR's labels and exits 1 if 'do not merge' is
present. It does not check out the repo, install anything, or call any
GitHub API — permissions: {} (no scopes at all) is correct here.

Author: arpitjain099

.github/workflows/do-not-merge.yml

@@ -12,6 +12,8 @@ on:
     branches: ["master"]
     types: [checks_requested]
 
+permissions: {}
+
 jobs:
   fail-by-label:
     runs-on: ubuntu-latest