squash: switch to per job permissions

.github/workflows/lint-pr-title.yaml

@@ -10,16 +10,6 @@ on:
       - synchronize
       - reopened
       - edited
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - edited
-
-permissions:
-  contents: read
-  pull-requests: write
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number }}  # Ensure that only one instance of this workflow is running per Pull Request
@@ -29,6 +19,9 @@ jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: amannn/action-semantic-pull-request@v5.4.0
         id: lint_pr_title