chore: set workflow permissions

[DerekRoberts]

This will soon start generating alerts if we don't fix it.

https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token

From #459:

Follows GitHub's best practices. Limit GITHUB_TOKEN's permissions (e.g. read only) to prevent misuse, like if an Action is compromised.

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions