Add issue-fields: read permission scope

[Copilot]

gh-aw didn't recognize issue-fields as a valid GitHub Actions permission scope, so workflows requesting it would fail validation with an "unknown permission scope" error. This scope is required to read org issue field definitions and values via GITHUB_TOKEN.

Changes

• pkg/workflow/permissions.go — adds PermissionIssueFields = "issue-fields" constant and includes it in GetAllPermissionScopes(), making it valid for GITHUB_TOKEN, recognized by the scope-name validator, rendered in YAML output, and included in read-all/write-all expansions

• Tests — updates four count-based merge assertions and the write-all dangerous-permissions count to reflect the new scope; adds issue-fields to the valid-scope enumeration test and a new ValidatePermissionScopeNames case

• Docs (reference/permissions.md) — lists issue-fields alongside other key scopes and adds a dedicated section explaining when it's needed and least-privilege guidance

permissions:
  contents: read
  issues: read
  issue-fields: read  # required for list_issue_fields, list_issue_types, and issue field value APIs