ci: scope down GitHub Token permissions

[AdnaneKhan]

Scope Down GitHub Token Permissions

This PR updates GitHub Actions workflows to use minimal required permissions instead of the default elevated permissions.

Why This Matters

Following the principle of least privilege, workflows should only have the specific permissions they need to function.

Changes

This PR adds explicit permissions: blocks to workflows that currently rely on default permissions, scoping them down to only what's required for their operations.

Please review the changes to ensure the specified permissions match your workflow requirements.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.73%. Comparing base (a66f87a) to head (83c6731).
⚠️ Report is 161 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #345   +/-   ##
=======================================
  Coverage   70.73%   70.73%           
=======================================
  Files          17       17           
  Lines        1753     1753           
=======================================
  Hits         1240     1240           
  Misses        427      427           
  Partials       86       86           

see 3 files with indirect coverage changes

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 57f4231...83c6731. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.