ci(FixPR): add explicit least-privilege permissions block

[kobihikri]

What this does

FixPR.yml is the only workflow of the 21 in .github/workflows/ with no permissions: block, so its GITHUB_TOKEN gets the repository's default scopes. This adds an explicit least-privilege block.

Why contents: write (not read)

The workflow runs on pull_request: [closed] when merged == true and its final step (EndBug/add-and-commit@v10) commits Cargo.lock back to main using GITHUB_TOKEN. So it genuinely needs contents: write — but nothing else. Making that explicit drops the other default token scopes (packages, actions, etc.) while keeping the auto-commit working.

This mirrors the hardening you already accepted in #12655 (adding an explicit permissions block to a workflow that CodeQL flagged).

Verification

for f in .github/workflows/*.yml; do grep -q 'permissions:' "$f" || echo "NO-PERMISSIONS: $f"; done
# → NO-PERMISSIONS: FixPR.yml   (only one, before this change)

Single-block addition, no behavior change.

---

Disclosure: I used an AI tool to help spot this and prepare the change; I verified it against the workflow and the #12655 precedent myself and take responsibility for it.

[HackingRepo]

there was still massive supply chain security prs, i open importantly #13286, but step by step security

[github-actions]

GNU testsuite comparison:

Skipping an intermittent issue tests/cut/bounded-memory (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/date/date-locale-hour (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/misc/io-errors (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/tail/retry (passes in this run but fails in the 'main' branch)
Skipping an intermittent issue tests/tail/tail-n0f (passes in this run but fails in the 'main' branch)

[cakebaker]

Thanks for your PR!