chore(workflows): tweak gh workflows

.github/workflows/update-submodules.yml

@@ -1,13 +1,14 @@
+---
 name: Update submodules
 on:
   schedule: [{ cron: 0 3 * * * }]
   workflow_dispatch:
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
 jobs:
   update-submodules:
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     runs-on: self-hosted
     steps:
       - name: Checkout repository