fix(autoupdate): let Renovate read issues in a private repo

Renovate queries the repository issues when it starts. The job token had
no issues permission, so a private repo returned FORBIDDEN and Renovate
stopped with platform-unknown-error. Public repos expose issues, which hid
the problem. Grant issues: read to the Renovate job.

.github/workflows/renovate-autoupdate.yaml

@@ -104,6 +104,8 @@ jobs:
     timeout-minutes: 45
     permissions:
       contents: write
+      # Renovate reads the repository's issues when it starts. A private repo refuses that without this.
+      issues: read
       pull-requests: write
     outputs:
       branches: ${{ steps.list.outputs.branches }}