ci: declare workflow-level contents: read on 4 workflows

.github/workflows/beta-docs.yaml

@@ -4,6 +4,9 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger-circleci:
     runs-on: ubuntu-latest

.github/workflows/nightly.yaml

@@ -1,6 +1,9 @@
 name: Manual nightly deploy
 on: workflow_dispatch
 
+permissions:
+  contents: read
+
 jobs:
   trigger-circleci:
     runs-on: ubuntu-latest

.github/workflows/prod-docs.yaml

@@ -4,6 +4,9 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   trigger-circleci:
     runs-on: ubuntu-latest

.github/workflows/weekly-chromatic.yml

@@ -5,6 +5,9 @@ on:
     - cron: '0 17 * * 1' # Monday 9am PST / 10am PDT (GH Actions cron is UTC)
   workflow_dispatch: # manual trigger for testing
 
+permissions:
+  contents: read
+
 jobs:
   chromatic:
     runs-on: ubuntu-latest