👷 Scope the triage GitHub App token

Request a token for this repository only, instead of every repository
in the installation, and only with the permissions the job uses: issues
(labels) and organization projects (the board). Also document why the
workflow needs pull_request_target and why it is safe.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>

.github/workflows/auto-label.yml

@@ -1,5 +1,8 @@
 name: Auto Label and Add to Project
 
+# pull_request_target is required so the GitHub App secrets are available
+# for PRs from forks. It is safe here: the job never checks out or runs PR
+# code, it only reads ids from the event payload.
 on:
   issues:
     types: [opened]
@@ -18,7 +21,10 @@ jobs:
         with:
           app-id: ${{ secrets.TRIAGE_APP_ID }}
           private-key: ${{ secrets.TRIAGE_APP_PRIVATE_KEY }}
-          owner: penpot
+          # No owner/repositories: the token is scoped to this repository.
+          # Organization permissions (the project board) still apply.
+          permission-issues: write
+          permission-organization-projects: write
 
       - name: Process Issue or PR
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0

.github/zizmor.yml

@@ -21,10 +21,6 @@ rules:
   dangerous-triggers:
     ignore:
       - auto-label.yml
-  # Scope GitHub App tokens.
-  github-app:
-    ignore:
-      - auto-label.yml
   # Style nudge towards the `$/...` syntax; not worth enforcing.
   self-repository:
     disable: true