ci: declare workflow-level contents: read on 2 workflows
#3603
+6
−0
contents: read on 2 workflows
#3603