chore(ci): set explicit least-privilege workflow permissions (#1099)

chore(ci): set explicit least-privilege workflow permissions (#1099) #678