ci: add explicit permissions to ci-package-manager

[Grit03]

Prerequisites checklist

• I have read the contributing guidelines.

AI acknowledgment

• I did not use AI to generate this PR.
• (If the above is not checked) I have reviewed the AI-generated content before submitting.

What is the purpose of this pull request?

Security hardening: this PR declares a workflow-level permissions: contents: read in ci-package-manager.yml, which currently inherits the default GITHUB_TOKEN permissions from the calling repository.

The main motivation is that the install jobs run lifecycle scripts from many third-party dependencies, so limiting the token to read-only reduces the blast radius if any of them is ever compromised.

What changes did you make? (Give an overview)

Added a workflow-level permissions block with contents: read only.

Is there anything you'd like reviewers to focus on?

I went through each job in the workflow to confirm this doesn't change any behavior:

• actions/checkout only needs contents: read.
• upload-artifact / download-artifact use the Actions runtime token, not GITHUB_TOKEN scopes.
• The install jobs (npm, Yarn v1, Yarn Modern, pnpm, bun) make no GitHub API calls.

Also, since this is a reusable workflow, a called workflow can only downgrade (never elevate) the caller's token — so this effectively caps the GITHUB_TOKEN for every repository that calls it.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: Grit03 / name: GyuriKim (4ebabe5)

[lumirlumir]

LGTM, thanks!