chore: grant pull-requests read for paths-filter API

.github/workflows/dotnet.yml

@@ -15,6 +15,12 @@ on:
   pull_request:
     branches: [main]
 
+# dorny/paths-filter reads the PR file list from the GitHub API; the default token
+# scope is too narrow without pull-requests:read ("Resource not accessible by integration").
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   build:
     runs-on: ubuntu-latest