Don't allow actions to update PR

Similar to #78, the default should be to _not_ allow actions to update
pull requests.

profiles/github/stacklok-profile-remediate.yaml

@@ -27,7 +27,7 @@ repository:
   - type: default_workflow_permissions
     def:
       default_workflow_permissions: read
-      can_approve_pull_request_reviews: true
+      can_approve_pull_request_reviews: false
   - type: dockerfile_no_latest_tag
     def: {}
   - type: branch_protection_enabled