Add explicit empty permissions block (permissions: {}) since this workflow only syncs milestones to Jira using its own secrets and needs no GITHUB_TOKEN permissions. Fixes code scanning alert #171. Closes scylladb/scylladb#29184