Add minimum token permissions for all GitHub workflow files

[Copilot]

This PR adds minimum token permissions to all 29 GitHub workflow files to improve the repository's security posture according to OpenSSF Scorecard recommendations.

Changes Made

Added root-level permissions: contents: read blocks to 26 workflow files that were missing them. The remaining 3 files (fossa.yml, nightly-release.yaml, and ossf-scorecard.yml) already had proper root-level permissions defined.

Implementation Details

• Consistent formatting: All permissions blocks follow the existing code style with proper blank line spacing
• Strategic placement: Permissions blocks are inserted immediately after the on: trigger block
• Minimal changes: Only 2-3 lines added per file, no existing code modified or deleted
• Job-level permissions preserved: Existing job-specific permissions (like in update-version.yaml) remain unchanged

Security Impact

This addresses the Token-Permissions check from the OpenSSF Scorecard by ensuring every workflow has explicitly defined permissions at the root level. Previously, workflows inherited default permissions which could be overly permissive.

The contents: read permission provides the minimum access needed for most CI/CD operations like checking out code and reading repository contents, while jobs that need additional permissions (like creating releases or updating PRs) retain their existing job-level permission declarations.

Verification

All 29 workflow files now pass permissions compliance checks with zero errors or warnings.

Fixes #45.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

@trask 👋 This repository doesn't have Copilot instructions. With Copilot instructions, I can understand the repository better, work faster and produce higher quality PRs.

I can generate a .github/copilot-instructions.md file for you automatically. Click here to open a pre-filled issue and assign it to me. I'll write the instructions, and then tag you for review.