Set actions.yml to run with read-only permissions

[pnacht]

Fixes https://github.com/keras-team/keras-core/issues/881.

This PR ensures all the jobs in the actions.yml workflow run with read-only permissions instead of the default write-all.

[codecov[bot]]

Codecov Report

Patch and project coverage have no change.

Comparison is base (bb21710) 76.49% compared to head (0e53250) 76.49%. Report is 3 commits behind head on main.

Additional details and impacted files

```diff @@ Coverage Diff @@ ## main #882 +/- ## ======================================= Coverage 76.49% 76.49% ======================================= Files 329 329 Lines 31334 31334 Branches 6100 6100 ======================================= Hits 23970 23970 Misses 5785 5785 Partials 1579 1579 ``` | [Flag](https://app.codecov.io/gh/keras-team/keras-core/pull/882/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=keras-team) | Coverage Δ | | |---|---|---| | [keras_core](https://app.codecov.io/gh/keras-team/keras-core/pull/882/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=keras-team) | `76.40% <ø> (ø)` | | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=keras-team#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.