VLN-497: Set explicit permissions for GitHub Actions workflows

[picatz]

Summary

• .github/workflows/ci.yml: Defined workflow-level permissions limiting the GITHUB_TOKEN to contents read and actions write so CI jobs can check out code while still saving caches and uploading artifacts.
• .github/workflows/conventions.yml: Added explicit permissions (contents read, actions read) for the reusable lint workflow which only checks out the repo and restores caches.
• .github/workflows/docs.yml: Set workflow permissions to contents read and actions read, matching the documentation build job’s need to restore caches without granting write scopes.
• .github/workflows/release.yml: Specified contents read and actions write permissions so release jobs can access the repo and perform cache and artifact upload operations without broader scope.
• .github/workflows/stress.yml: Declared contents read and actions write permissions required for stress runs that restore/save caches and upload test artifacts.
• .github/workflows/nightly-throughput-stress.yml: Introduced contents read and actions write permissions to support nightly throughput stress runs that rebuild artifacts, manage caches, and upload logs.
• .github/workflows/nightly.yml: Added contents read and actions write permissions so the nightly wrapper workflow passes the required scopes to the reusable stress workflow it invokes.
• .github/workflows/omes.yml: Set workflow permissions to contents read and packages write, allowing the OMES reusable workflow to access the repo and push container images while keeping other scopes disabled.