[github-actions] Reduce workflow token permissions (#63)

[coisa]

Summary

• Reduce tests.yml workflow and packaged stub to read-only repository contents.
• Move reports/wiki write permissions to the jobs that push generated content or clean previews.
• Split reports preview commenting into its own job with pull-requests: write.
• Declare issues: read for label sync and document the remaining required write scopes.

Verification

• ruby -e 'require "yaml"; ARGV.each { |file| YAML.load_file(file); puts "ok #{file}" }' .github/workflows/*.yml resources/github-actions/*.yml
• git diff --check

Notes

• composer dev-tools docs and PHP-based hooks could not run locally because this shell does not have php on PATH.
• Current reports publishing uses the gh-pages branch, so publish and cleanup jobs still require contents: write instead of pages: write/id-token: write.

Closes #63

[github-actions]

🚀 Preview is available for this pull request.

• Docs: https://php-fast-forward.github.io/dev-tools/previews/pr-89/
• Coverage: https://php-fast-forward.github.io/dev-tools/previews/pr-89/coverage/