chore: restrict GitHub workflow permissions - future-proof

[incertum]

See swiftlang/github-workflows#167 for additional context

This approach aligns with security best practices, as detailed in the following documentation:

• https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions
• https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#defining-access-for-the-github_token-scopes
• https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/