ci: scope down GitHub Token permissions

[AdnaneKhan]

Scope Down GitHub Token Permissions

This PR updates GitHub Actions workflows to use minimal required permissions instead of the default elevated permissions.

Why This Matters

Following the principle of least privilege, workflows should only have the specific permissions they need to function.

Changes

This PR adds explicit permissions: blocks to workflows that currently rely on default permissions, scoping them down to only what's required for their operations.

Please review the changes to ensure the specified permissions match your workflow requirements.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.28%. Comparing base (09e6487) to head (d6fc329).
⚠️ Report is 521 commits behind head on main.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@              Coverage Diff              @@
##               main    #1243       +/-   ##
=============================================
- Coverage     85.71%   67.28%   -18.43%     
- Complexity       19      525      +506     
=============================================
  Files             3       54       +51     
  Lines            49     2693     +2644     
  Branches          5      373      +368     
=============================================
+ Hits             42     1812     +1770     
- Misses            3      746      +743     
- Partials          4      135      +131     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.