approved-for-ci-run.yml: fix variable name and permissions

[bayandin]

Problem

• gh pr list fails with unknown argument "main"; please quote all values that have spaces due to using a variable with wrong name
• permissions: write-all are too wide for the job

Summary of changes

• For variable name HEAD -> BRANCH
• Grant only required permissions for each job (I've checked permissions here: https://github.com/bayandin/github-token-least-permissions/blob/main/.github/workflows/test-permissions.yml)

Checklist before requesting a review

• I have performed a self-review of my code.
• If it is a core feature, I have added thorough tests.
• Do we need to implement analytics? if so did you add the relevant metrics to the dashboard?
• If this PR requires public announcement, mark it with /release-notes label and add several sentences in this section.

Checklist before merging

• Do not forget to reformat commit message to not include the above checklist

[koivunej]

Let's try this

[github-actions]

2472 tests run: 2353 passed, 0 failed, 119 skipped (full report)

---

Flaky tests (4)

Postgres 16

• test_partial_evict_tenant: debug, release
• test_timeline_status[True]: release
• test_wal_lagging: release

Code coverage (full report)

• functions: 53.0% (7667 of 14455 functions)
• lines: 81.0% (44758 of 55282 lines)

---

_{The comment gets automatically updated with the latest test results
53ac760 at 2023-09-14T17:01:02.884Z :recycle:}