gha: Grant PR review permissions required by v2.0.3

`docker-agent-action` v2.0.3 requires callers of its reusable PR
review workflow to grant `actions: write` for review-lock cache
cleanup and feedback artifacts. Earlier releases required only
`actions: read`. See:

https://github.com/docker/docker-agent-action#pr-review-workflow

Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>

.github/workflows/pr-review.yml

@@ -18,6 +18,6 @@ jobs:
       issues: write # Create security incident issues if secrets detected
       checks: write # (Optional) Show review progress as a check run
       id-token: write # Required for OIDC authentication to AWS Secrets Manager
-      actions: read # Download artifacts from trigger workflow
+      actions: write # Required since v2.0.3 — review-lock cache cleanup and feedback artifacts
     with:
       trigger-run-id: ${{ github.event_name == 'workflow_run' && format('{0}', github.event.workflow_run.id) || '' }}