Add explicit permissions to GitHub Actions

[QuLogic]

PR Summary

While everything we do is basically public, there's no reason to give the tokens on these jobs full permissions. (Note, once a single item is added, all other permissions are disabled.)

Also update the CircleCI check to the action's latest recommended jobs.

PR Checklist

Documentation and Tests

• [n/a] Has pytest style unit tests (and pytest passes)
• [n/a] Documentation is sphinx and numpydoc compliant (the docs should build without error).
• [n/a] New plotting related features are documented with examples.

Release Notes

• [n/a] New features are marked with a .. versionadded:: directive in the docstring and documented in doc/users/next_whats_new/
• [n/a] API changes are marked with a .. versionchanged:: directive in the docstring and documented in doc/api/next_api_changes/
• [n/a] Release notes conform with instructions in next_whats_new/README.rst or next_api_changes/README.rst

[QuLogic]

I threw in a few bugs, and they were correctly reported, so I've removed them now. Not 100% confident on the nightly bits, as the GitHub docs are a bit vague on what the permissions do, but I think they're correct.

[lumberbot-app]

Owee, I'm MrMeeseeks, Look at me.

There seem to be a conflict, please backport manually. Here are approximate instructions:

1. Checkout backport branch and update it.

git checkout v3.6.x
git pull

2. Cherry pick the first parent branch of the this PR on top of the older branch:

git cherry-pick -x -m1 24f912845dd2765c86863945ed9a5fda82ed418b

3. You will likely have some merge/cherry-pick conflict here, fix them and commit:

git commit -am 'Backport PR #24579: Add explicit permissions to GitHub Actions'

4. Push to a named branch:

git push YOURFORK v3.6.x:auto-backport-of-pr-24579-on-v3.6.x

5. Create a PR against branch v3.6.x, I would have named this PR:

"Backport PR #24579 on branch v3.6.x (Add explicit permissions to GitHub Actions)"

And apply the correct labels and milestones.

Congratulations — you did some good work! Hopefully your backport PR will be tested by the continuous integration and merged soon!

Remember to remove the Still Needs Manual Backport label once the PR gets merged.

If these instructions are inaccurate, feel free to suggest an improvement.