fix: pull-requests:write required to label PRs from forks

GitHub's label endpoint requires both issues=write and pull_requests=write
when the target is a pull request, even though it routes via /issues/.