ci: restrict permissions for gh workflows

[aramase]

• explicitly set permissions for each workflow
• changed the default workflow permissions to read only with this change.

[codecov]

Codecov Report

Merging #1428 (7929927) into master (6dc82f9) will decrease coverage by 0.45%.
The diff coverage is 29.77%.

@@            Coverage Diff             @@
##           master    #1428      +/-   ##
==========================================
- Coverage   36.29%   35.85%   -0.45%     
==========================================
  Files          27       32       +5     
  Lines        2915     4435    +1520     
==========================================
+ Hits         1058     1590     +532     
- Misses       1778     2761     +983     
- Partials       79       84       +5     

Impacted Files	Coverage Δ
...adpodidentity/aadpodidentity_deepcopy_generated.go	0.00% <ø> (ø)
...odidentity/v1/aadpodidentity_deepcopy_generated.go	0.00% <ø> (ø)
pkg/apis/aadpodidentity/v1/register.go	0.00% <0.00%> (ø)
pkg/cloudprovider/vm.go	27.89% <0.00%> (+2.20%)	⬆️
pkg/cloudprovider/vmss.go	21.33% <0.00%> (+2.24%)	⬆️
pkg/crd/crd.go	0.99% <0.00%> (+0.32%)	⬆️
pkg/k8s/client.go	5.06% <0.00%> (+1.25%)	⬆️
pkg/k8s/fake.go	0.00% <0.00%> (ø)
pkg/log/options.go	23.80% <0.00%> (-1.20%)	⬇️
pkg/nmi/managed.go	31.25% <0.00%> (+5.44%)	⬆️
... and 10 more

... and 12 files with indirect coverage changes