.github/workflows: fix author permission check for external PRs

getCollaboratorPermissionLevel never returns 'none' for a real user on
a public repository -- every GitHub user has at least 'read' access to
ceph/ceph. As a result the permission === 'none' branch only ever fired
for bot accounts (which 404 and fall through to the default), so human
external contributors never received the needs-ci-approval label or the
notification comment, and ci-approved was never revoked on new pushes.

Require 'write' or 'admin' instead. Note the permission field maps the
'maintain' role to 'write' and 'triage' to 'read', so triage users (who
cannot push) still correctly require CI approval.

Signed-off-by: David Galloway <david.galloway@ibm.com>