ci: Add explicit permissions to workflows

[philippemnoel]

Every workflow lacking a permissions: block inherits the repository default for GITHUB_TOKEN, which is currently write across the org. That grants linters and test workflows push access they never use.

This adds a minimal top-level block to each workflow that had none:

• contents: read for linters, tests, and workflows that authenticate to external services with their own credentials
• elevated scopes only where the workflow demonstrably needs them (release publishing, issue creation)

Workflows that already declare workflow- or job-level permissions are untouched. Pure additions, no deletions.

This is a prerequisite for switching the org default workflow permissions to read-only — flipping that setting first would break the workflows that currently rely on implicit write.

Found via GitHub's Code Security assessment ("Workflow does not contain permissions", Medium, 35 findings), then audited across all non-archived, non-fork repos.

https://claude.ai/code/session_01Rg3UBFSnmKMPQLNpNKkn8d

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.37%. Comparing base (73cf5e3) to head (3646ded).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #125   +/-   ##
=======================================
  Coverage   90.37%   90.37%           
=======================================
  Files          20       20           
  Lines        2411     2411           
  Branches      774      774           
=======================================
  Hits         2179     2179           
- Misses        190      232   +42     
+ Partials       42        0   -42     

Flag	Coverage Δ
rails-paradedb	90.37% <ø> (ø)
rb3.2	90.65% <ø> (ø)
rb3.3	90.65% <ø> (ø)
rb3.4	90.37% <ø> (ø)
rb4.0	81.87% <ø> (ø)
rl7.2	90.37% <ø> (ø)
rl8.1	81.87% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 6 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.