[CI] Code coverage report not shown when PR is generated from fork

As seen here https://github.com/android/nowinandroid/pull/1359

`Error: HttpError: Resource not accessible by integration`

We probably need to add
```
permissions:
pull-requests: write
```

to that job.

Find the GitHub Actions workflow job that publishes the code coverage report for pull requests, then reproduce or inspect the fork-based failure shown in PR #1359. Verify the job's pull-request permissions and confirm that coverage is posted successfully for a pull request from a fork.

Written by the indexing model from the issue text.