fix: grant gitleaks pull-requests: read

gitleaks-action reads a pull request's commits through the API
(GET .../pulls/{n}/commits), which needs pull-requests: read — the job
only had contents: read, so every PR run hit a 403.

Claude-Session: https://claude.ai/code/session_01J4HB8qJjdZwaAv42k6HMpv

Author: nghiatruongtps

.github/workflows/app-security.yml

@@ -54,6 +54,9 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      # gitleaks-action reads the pull request's commits through the API
+      # (GET .../pulls/{n}/commits) instead of the diff already on disk.
+      pull-requests: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: