chore(ci): add explicit least-privilege workflow permissions

chore(ci): add explicit least-privilege workflow permissions #4702