fix permissions for codeql-action

[yaacovCR]

see https://github.com/graphql/graphql-js/actions/runs/3688795010/workflow error:

The workflow is not valid. .github/workflows/pull_request.yml (Line: 5, Col: 3): Error calling workflow 'graphql/graphql-js/.github/workflows/ci.yml@07f3822'. The nested job 'Run CodeQL security scan' is requesting 'security-events: write', but is only allowed 'security-events: none'.

[netlify]

✅ Deploy Preview for compassionate-pike-271cb3 ready!

Name	Link
🔨 Latest commit	db23339
🔍 Latest deploy log	https://app.netlify.com/sites/compassionate-pike-271cb3/deploys/639a1a951aba5f0008bd3f6a
😎 Deploy Preview	https://deploy-preview-3800--compassionate-pike-271cb3.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site settings.

[github-actions]

Hi @yaacovCR, I'm @github-actions bot happy to help you with this PR 👋

Supported commands

Please post this commands in separate comments and only one per comment:

• @github-actions run-benchmark - Run benchmark comparing base and merge commits for this PR
• @github-actions publish-pr-on-npm - Build package from this PR and publish it on NPM