When we want to merge pull-request while GitHub Action's workflow without PAT, then we may want to create a GitHub App and use its ephemeral token.
However, to find the correct pemission setting is very frustrated. Here is minimum permissions requirements to exec `gh pr merge`.

Contents: Read and write
Metadata: Read-only
Pull request: Read and write