fix(check_pr): Fix vulnerability

[cap-ang]

Fix Low Github Script injection

List of Changes

• Fix Github Script injection on github.head_ref.
• Move permissions at job level.

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.

[github-actions]

Comment this PR with update_code to update openapi.json and format the code. Consider to use pre-commit to format the code.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud