ci(workflows): improve security and update actions

- set top-level explicit permissions for each GitHub Actions workflow for improved security and deduplication of permissions.
- add `persist-credentials: false` to actions/checkout for improved security - see https://github.com/actions/checkout#checkout-v4
- update actions/checkout from v4 to v5

.github/workflows/chore-pr-comments.yml

@@ -3,20 +3,13 @@ on:
   pull_request_target:
     types:
       - labeled
+
+permissions:
+  pull-requests: write
+
 jobs:
   add-comment:
     runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-      contents: read
-      actions: none
-      checks: none
-      deployments: none
-      issues: none
-      packages: none
-      repository-projects: none
-      security-events: none
-      statuses: none
     strategy:
       matrix:
         include: