Added default WF permission to read-only

[soumeh01]

Addressing partially: #221

Fixes

• Only read access is granted by default, ensuring that:
  • Workflows and actions cannot modify repositories, secrets, or other sensitive resources unless explicitly allowed
  • Limits the blast radius if a workflow is compromised
  • Prevents Accidental Writes

[jreineckearm]

Seems to be working again. Good to merge.