Move all permissions to top-level

Author: tstellar

.github/workflows/new-prs.yml

@@ -2,6 +2,7 @@ name: "Labelling new pull requests"
 
 permissions:
   contents: read
+  pull-requests: write
 
 on:
   # It's safe to use pull_request_target here, because we aren't checking out
@@ -16,9 +17,6 @@ on:
 
 jobs:
   automate-prs-labels:
-    permissions:
-      contents: read
-      pull-requests: write
     runs-on: ubuntu-latest
     # Ignore PRs with more than 10 commits.  Pull requests with a lot of
     # commits tend to be accidents usually when someone made a mistake while trying