fix(ci): grant write permissions required by auto-merge, quality-report, and CodeQL

- auto-merge.yml: pull-requests write for pulls.merge
- quality-gate.yml: job-level pull-requests write for PR comments
- sast.yml: security-events write for CodeQL SARIF upload

Author: cursoragent

.github/workflows/auto-merge.yml

@@ -1,7 +1,7 @@
 name: Auto Merge
 permissions:
   contents: read
-  pull-requests: read
+  pull-requests: write
 
 on:
   pull_request:

.github/workflows/quality-gate.yml

@@ -141,6 +141,9 @@ jobs:
     needs: [unit-tests, e2e-tests, integration-tests, fr-annotation-check]
     if: always()
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.1
 

.github/workflows/sast.yml

@@ -2,6 +2,7 @@ name: Security (SAST)
 permissions:
   contents: read
   pull-requests: read
+  security-events: write
 on:
   push:
     branches: [main, develop]