Potential fix for code scanning alert no. 1: Workflow does not contain permissions

[thpierce]

Potential fix for https://github.com/aws-observability/aws-otel-dotnet/security/code-scanning/1

To fix the problem, add an explicit permissions block to the workflow or the affected job to restrict the GITHUB_TOKEN's permissions to only what is required. As only issue and PR labeling, marking, and closing functionality are needed for the actions/stale@v6 step, specifying contents: read, issues: write, and pull-requests: write is recommended. This block can be placed at the workflow root (affecting all jobs) or for the specific job ("stale-close"). Since this workflow only has one job, either location is equivalent, but best practice is to set it at the job level for clarity.

Add the following block under jobs.stale-close: (after line 21 and before runs-on:):

permissions:
  contents: read
  issues: write
  pull-requests: write

No imports or other code definitions are required.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[ezhang6811]

This PR seems like the best application of least permissions principle.
aws-observability/aws-otel-python#99 has contents: write which shouldn't be necessary
https://github.com/aws-observability/aws-otel-ruby/pull/159/files places this at the workflow level instead of job level.

recommend having both those PRs match this one, though not blocking.

[thpierce]

aws-observability/aws-otel-python#99 has contents: write which shouldn't be necessary
I think you ment ruby - I'm going to skip as I don't think it's critical.

https://github.com/aws-observability/aws-otel-ruby/pull/159/files places this at the workflow level instead of job level.
I think you ment python - Fixed

Integration Test / Integration Test (push) seems unhealthy, but not related to this PR so will bypass.