Make sure that build-images workflow has permissions to read PR info (apache#24897)

For a public repo this information is public so no extra permission is
required, but just in case this workflow ends up against a private repo
we need these permissions explicitly.

Author: ashb

.github/workflows/build-images.yml

@@ -22,6 +22,7 @@ on:  # yamllint disable-line rule:truthy
 permissions:
   # all other permissions are set to none
   contents: read
+  pull-requests: read
 env:
   MOUNT_SELECTED_LOCAL_SOURCES: "false"
   ANSWER: "yes"