ci: explicit permissions and remove pull_request_target (#704)

Author: doublethink

.github/workflows/ci.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   xcodebuild-latest:
     name: xcodebuild (16)

.github/workflows/conventional-commits.yml

@@ -2,12 +2,16 @@
 name: 'PR Title is Conventional'
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited
       - synchronize
 
+permissions:
+  pull-requests: write
+  contents: read
+
 jobs:
   main:
     name: Validate PR title