Potential fix for pull request finding 'CodeQL / Workflow does not contain permissions'

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

Author: hunngu-ms

.github/workflows/asim-pr-label-notify.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [labeled, opened, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   # ════════════════════════════════════════════════════════════════════════
   # JOB 1: Triggered when PR is labeled/opened — creates ADO work item