Add restrictive default permissions to workflows

[bestbeforetoday]

The default workflow permissions configured on the repository are already restrictive but explicitly setting permissions in each workflow makes the OSSF Scorecard checks happier.