breaking: Add explicit permissions to workflows

[carlcsaposs-canonical]

• Add permissions to reusable workflow internal jobs to drop to minimal permissions (for GITHUB_TOKEN), regardless of permissions set by the caller repository
• Update usage docs examples to call reusable workflows with minimal permissions
• Set minimal permissions for data-platform-workflows repository internal workflows (workflows beginning with two underscores in file name)

Breaking change since contents: read and actions: read permissions were added to some workflows (which requires caller to add those permissions)—it is not needed for public repositories, but is necessary for the workflows to succeed on private repositories. In order to drop to minimal permissions on the reusable workflows (e.g. so that other permission scopes are none) we have to set these on both public & private repositories. It might be possible to dynamically set this—but since these are read-only scopes, there is minimal additional risk—so it does not seem worth additional complexity to avoid the additional scopes for public repos only. Furthermore, for public repositories, it appears these read-only scopes do not grant additional permissions since the endpoints appear to already be available without authentication for public repositories: https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-contents, https://docs.github.com/en/rest/authentication/permissions-required-for-github-apps?apiVersion=2022-11-28#repository-permissions-for-actions

Migration instructions

For each reusable workflow, check the usage docs (https://github.com/canonical/data-platform-workflows?tab=readme-ov-file#usage) and, for each workflow call, update permissions to match the usage docs

[carlcsaposs-canonical]

Merge after #343 and rebase (base branch is currently #343)

[taurus-forever]

Thank you for adding comments for most of perms. Would be great to have a followup task to decrease perms further.

[carlcsaposs-canonical]

Would be great to have a followup task to decrease perms further.

wdym?

the permissions are needed for the workflows to function with the exception of contents: read and actions: read on public repos only (with rationale for keeping in PR description)

[reneradoi]

Thank you Carl!