[fix] missing PR perm data-update.yml workflow (#4737)

We actually don't need to keep the token on checkout because `peter-evans/create-pull-request` will read from `github.token`. The obvious `pull-requests` write permission wasn't set in the last fix, so I added it now.

.github/workflows/data-update.yml

@@ -36,6 +36,7 @@ jobs:
 
     permissions:
       contents: write
+      pull-requests: write
 
     steps:
       - name: Setup Python
@@ -45,6 +46,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: "false"
 
       - name: Setup cache Python
         uses: actions/cache@v4