Document permissions for github action?

Maybe document required permissions, for the action to work?

I feel like we can avoid some friction like that, when setting up the action 🙂  

```yml
permissions:          
  contents: read      
  pull-requests: write
```