The default workflow permissions are overly broad; setting permissions
explicitly at the workflow level ensures excessive permissions are not
unintentionally granted to jobs. For details, see:
https://docs.zizmor.sh/audits/#excessive-permissions
Splitting it on word boundaries rather than only spaces allows for better
detection. The issue labeler previously didn't catch titles such as
`treesitter: noisy "Invalid node type" error`.
Co-authored-by: casswedson <casswedson@users.noreply.github.com>
