update permission from caller

[maryliag]

Update example on readme to make it clear that the caller needs to add the permission to be able to add the comment and label

[Copilot]

Pull request overview

This PR improves the first-time-pr/README.md consumer documentation to make explicit that the caller workflow must grant pull-requests: write at the job level for the reusable workflow to function. Previously the examples omitted the caller-side permissions: block, which could lead adopters to hit permission failures when the label/comment steps run. I verified every technical claim against the actual reusable workflow (.github/workflows/first-time-pr.yml), which declares pull-requests: write for exactly the gh pr edit --add-label and gh pr comment steps described in the README.

Changes:

• Added job-level permissions: pull-requests: write (and top-level permissions: {}) to both example caller snippets, with inline comments explaining why.
• Added a new "Required permissions" section explaining that a reusable workflow's permissions are capped by the caller's grants.
• Added a zizmor: ignore[dangerous-triggers] inline comment on the pull_request_target: trigger plus a note clarifying it only matters for repos running zizmor.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.