update CLA yaml config

.github/workflows/cla.yml

@@ -5,6 +5,13 @@ on:
   pull_request_target:
     types: [opened, closed, synchronize]
 
+# explicitly configure permissions, in case your GITHUB_TOKEN workflow permissions are set to read-only in repository settings
+permissions:
+  actions: write
+  contents: write # this can be 'read' if the signatures are in remote repository
+  pull-requests: write
+  statuses: write
+
 jobs:
   CLAssistant:
     runs-on: ubuntu-latest