ci: restrict workflow token permissions to read-all

Adds `permissions: read-all` at the workflow level for all four
workflows so the default token is least-privilege. Jobs that need
write access (deploy-pages) already carry their own permissions block.

Fixes OpenSSF Scorecard Token-Permissions check (0/10).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: say-paul

.github/workflows/analysis.yml

@@ -6,6 +6,8 @@ on:
   schedule:
     - cron: '19 20 * * 6'
 
+permissions: read-all
+
 jobs:
   analysis_devskim:
     name: DevSkim

.github/workflows/ci.yml

@@ -6,6 +6,8 @@ on:
 
 name: Continuous integration
 
+permissions: read-all
+
 jobs:
   check-spelling:
     name: Check spelling

.github/workflows/comment-ci.yaml

@@ -5,6 +5,8 @@ on:
   issue_comment:
     types: [created]
 
+permissions: read-all
+
 jobs:
   check-pull-request:
     runs-on: ubuntu-latest

.github/workflows/greenboot-ci.yaml

@@ -5,6 +5,8 @@ on:
   pull_request_target:
     types: [opened, synchronize, reopened]
 
+permissions: read-all
+
 jobs:
   check-pull-request:
     runs-on: ubuntu-latest