build: Set token permissions for go.yml.

[arjundashrath]

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

StepSecurity is working on securing GitHub workflows and OSSF Scorecards recommends using StepSecurity's secure-workflows online tool app.stepsecurity.io to improve the security of GitHub workflows.

This repository has a Scorecards score in the Token-Permissions category of 0/10.

We have fixed one of the repo's workflows for you by adding permissions for the involved jobs. You can secure the rest of the workflows for improved security by using the StepSecurity online tool at app.stepsecurity.io.

[davecgh]

Thanks for the PR. It's a good idea to explicitly specify it in the YAML as well, but for reference, we do have the default permissions set to read-only in the repository settings.