ci: set top-level permissions as well

It should turn on the "restricted" mode by default regardless of
whether the global setting is on or not. New jobs in this action
should have to overwrite it explicitly to gain write access in any
way.

It should also make the action consistent with the other actions
writing various stuff like 'labeler' and 'codeql'.

.github/workflows/issue_labeler.yml

@@ -5,6 +5,9 @@ on:
   issues:
     types: [ opened ]
 
+permissions:
+  contents: read
+
 jobs:
   label-component:
     runs-on: ubuntu-22.04