add zizmore ignore rule (#239)

Author: kevinwcyu

.github/workflows/pr-commands.yml

@@ -1,17 +1,18 @@
 name: PR automation
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - labeled
       - opened
 concurrency:
   group: pr-commands-${{ github.event.number }}
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   main:
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Actions