chore(ci): narrow permissions used in actions

[miketheman]

Description

Narrows permissions used in GitHub Actions to only what is needed to run.

Refs: https://docs.zizmor.sh/audits/#excessive-permissions

Type of change

Select the statement best describes this pull request.

• This is a infrastructure update (docs, ci, etc)

Does your PR include tests

If you are fixing a bug or adding a feature, we appreciate (but do not require)
tests to support whatever fix of feature you're implementing.

• This change doesn't require tests

Did you include your contribution to the change log?

• Yes, changelog.md is up-to-date.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.77%. Comparing base (08f8eb0) to head (800e9b8).
⚠️ Report is 23 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #648   +/-   ##
=======================================
  Coverage   90.77%   90.77%           
=======================================
  Files           9        9           
  Lines        1973     1973           
  Branches      144      144           
=======================================
  Hits         1791     1791           
  Misses        142      142           
  Partials       40       40           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[lwasser]

Thanks again for this @miketheman approving and merging!