CI: set minimal permissions to GitHub Workflows

[diogoteles08]

Set top-level read-only permissions to all workflows; for the jobs that require write-permissions, give them only job-level

Closes #366