[sr-dev] git:master:8064a1d3: build: harden pull_request.yml permissions