ci: restrict access to `GITHUB_TOKEN` for workflows

[mmalenic]

Of the workflows that use the GITHUB_TOKEN, it's access could be restricted to only actions that are required, using the permissions key: https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token. Related to #226.