ci: prevent `GITHUB_TOKEN` from modifying the repository

[abrown]

This change ostensibly protects the repository from CI attacks by limiting wha the GITHUB_TOKEN can do. See the token permissions documentation at:

• OpenSSF
• GitHub