GH Actions: set permissions for each workflow/job

[jrfnl]

Users frequently over-scope their workflow and job permissions, or set broad workflow-level permissions without realizing that all jobs inherit those permissions.

Furthermore, users often don't realize that the default GITHUB_TOKEN permissions can be very broad, meaning that workflows that don't configure any permissions at all can still provide excessive credentials to their individual jobs.

Remediation
In general, permissions should be declared as minimally as possible, and as close to their usage site as possible.

In practice, this means that workflows should almost always set permissions: {} at the workflow level to disable all permissions by default, and then set specific job-level permissions as needed.

Includes minor tweaks for consistency in the comments and the order of the GHA instructions.

Refs:

• https://docs.zizmor.sh/audits/#excessive-permissions

[jrfnl]

@diedexx Would you like to review this PR ?

[diedexx]

Thanks 🙌

[jrfnl]

@diedexx All good. FYI: I'm planning to do the same for all the plugin repos over the next few weeks. Just thought I'd let someone review this one as these are re-used, so have higher and indirect impact. Thanks for having a look.