fix(ci): provide necessary permissions for calling workflow

Also error on the side of security adding an extra check on the
automatic PR step.

.github/workflows/api-docs-check.yml

@@ -12,6 +12,9 @@ on:
 jobs:
   call-regen-api-docs:
     if: github.event.pull_request.draft == false
+    permissions:
+      contents: write
+      pull-requests: write
     uses: ./.github/workflows/api-docs.yml
     with:
       check_only: true

.github/workflows/api-docs.yml

@@ -60,7 +60,7 @@ jobs:
           exit 1
 
       - name: Automatic PR
-        if: ${{ steps.docs.outputs.UPDATED_DOCS != 0 }}
+        if: ${{ steps.docs.outputs.UPDATED_DOCS != 0 && !inputs.check_only }}
         run: |
           git add -u
           git commit -m 'docs: regenerate [skip ci]'