Add clarification regarding contents permissions

Author: yairm210

README.md

@@ -220,6 +220,8 @@ permissions:
   contents: write
 ```
 
+By default, these permissions are granted on `push` but not on `pr` - and you should be wary of adding them, as they allow [wide access to changing the entire repo's contents](https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-contents)
+
 ## Releasing
 
 To release this Action: