Lock down workflow permissions. (#19406)

Co-authored-by: Joel Challis <[email protected]>

.github/workflows/stale.yml

@@ -1,13 +1,14 @@
 name: 'Close stale issues and PRs'
-on:
-  schedule:
-    - cron: '30 1 * * *'
-  workflow_dispatch:
 
 permissions:
   issues: write
   pull-requests: write
 
+on:
+  schedule:
+    - cron: '30 1 * * *'
+  workflow_dispatch:
+
 jobs:
   stale:
     runs-on: ubuntu-latest