ci: Harden GitHub Actions permissions

[jbeckwith-oai]

Summary

• Add fail-closed workflow-level permissions to CI and release workflows.
• Grant explicit read-only repository access only to jobs that need checkout.
• Prevent checkout from persisting the default GitHub token into local git config.

Validation

• Parsed both workflow YAML files with Ruby YAML.load_file.
• Verified every workflow uses: reference is pinned to a 40-character SHA.

Notes

• Preserves id-token: write where OIDC is actually used: CI artifact upload and RubyGems trusted publishing.