fix(github): PR labeling permission

Finally found the documentation:
"GitHub only grants read access tokens for `pull_request` events, at most. If you encounter an `Error: HttpError: Resource not accessible by integration`, it's likely due to these permission constraints. To resolve this issue, you can modify the `on:` section of your workflow to use `pull_request_target` instead of `pull_request`"
- https://github.com/actions/labeler?tab=readme-ov-file#permissions

.github/workflows/pr_opened.yml

@@ -1,6 +1,6 @@
 name: Validate PR
 on:
-  pull_request:
+  pull_request_target:
     types: [ reopened, opened, edited, synchronize, ready_for_review ]
     paths:
       - 'code/**'
@@ -14,7 +14,6 @@ on:
       - '!*.sh'
 
 permissions:
-  issues: write
   pull-requests: write
 
 concurrency: