ci: set workflow permissions

[eoaksnes]

This pull request updates several GitHub Actions workflow files to explicitly set permissions for improved security and clarity. The changes ensure that each workflow only requests the minimum permissions needed for its tasks, following GitHub best practices.

Permissions configuration updates:

• Added contents: read permission to the top-level of .github/workflows/on-push-main.yml, .github/workflows/on-push.yml, and .github/workflows/tests.yml to allow workflows to access repository contents. [1] [2] [3]
• Added contents: write permission to the Build and deploy docs to Github pages job in .github/workflows/on-push-main.yml so it can publish documentation to GitHub Pages.
• Added issues: write and pull-requests: write permissions to .github/workflows/stale.yml to allow the workflow to mark issues and pull requests as stale.

Simplification and cleanup:

• Removed redundant and unnecessary permissions from the jobs: section of .github/workflows/codeql.yml to streamline the workflow configuration.