CI: fix the two workflows (which modify labels) failing when HEAD is in a fork

[boneskull]

Despite my previous flimsy efforts, these two workflows (the auto-labeler and the "fail check if On Hold label is present") error out on PRs from external repositories. One of two solutions:

• (Ideal) Make it work by carefully limiting the permissions
• Just don't run them at all

I'm not sure offhand how to do either, so I'll need to figure that out.