Scope patch release workflow write permissions to its job

[theletterf]

Summary

• add permissions: {} at the workflow level for patch-release-version-bump.yml
• grant contents: write and pull-requests: write only to the create-pull-request job
• keep the workflow compatible with a read-only default GITHUB_TOKEN

Contributes to elastic/docs-actions#187.

Test plan

• Reviewed the workflow to confirm it uses secrets.GITHUB_TOKEN for create-pull-request
• Verified the diff only scopes the required explicit permissions
• Optional: run the workflow in GitHub if runtime confirmation is needed

Made with Cursor

[github-actions]

A documentation preview will be available soon.

• 🔨 Buildkite builds
• 📚 HTML diff
• 📙 Preview page

Request a new doc build by commenting

• Rebuild this PR: run docs-build
• Rebuild this PR and all Elastic docs: run docs-build rebuild

_{run docs-build is much faster than run docs-build rebuild. A rebuild should only be needed in rare situations.}

_{If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here.}