Potential fix for code scanning alert no. 261: Workflow does not contain permissions

[joel-rieke]

Potential fix for https://github.com/trimble-oss/go-mysql-server/security/code-scanning/261

In general, the fix is to add an explicit permissions block to the workflow to scope the GITHUB_TOKEN to the least privileges required. Since this workflow reads and writes pull requests and issues (comments and closing PRs), it needs pull-requests: write and issues: write; it does not need broader contents: write, so we can keep repository contents access to read. Placing the permissions block at the top level (next to name and on) will apply it to all jobs, which is simplest and maintains consistent behavior. If any job later needs different permissions, a job-level override can be added, but nothing in the shown snippet requires broader access than PR/issue writes and read-only contents.

Concretely, edit .github/workflows/bump-dependency.yaml near the top of the file, after the name: Bump Deps line and before the on: block, to add:

permissions:
  contents: read
  pull-requests: write
  issues: write

No other changes are required: no imports or additional definitions are needed, and all jobs will now run with these explicit permissions instead of inheriting unspecified defaults.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.