ci: set read-only workflow token permissions

[Alb3e3]

Summary

• set explicit read-only GITHUB_TOKEN permissions for CI workflows that only need repository checkout/read access
• leave release/deploy/write-capable workflows unchanged

Why

This follows GitHub Actions least-privilege guidance and reduces the default token scope available to routine CI jobs without changing the test/build commands.

Verification

• Parsed the changed workflow YAML with PyYAML.
• Ran git diff --check.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 0.22%. Comparing base (dba5885) to head (e676b9d).
⚠️ Report is 27 commits behind head on master.

❗ There is a different number of reports uploaded between BASE (dba5885) and HEAD (e676b9d). Click for more details.

HEAD has 2 uploads less than BASE

Flag	BASE (dba5885)	HEAD (e676b9d)
authIntTests	1	0
mgmtIntTests	1	0

Additional details and impacted files

@@             Coverage Diff             @@
##           master    #1054       +/-   ##
===========================================
- Coverage   25.53%    0.22%   -25.32%     
===========================================
  Files        3156     3138       -18     
  Lines      148320   148192      -128     
  Branches    10021    10012        -9     
===========================================
- Hits        37874      330    -37544     
- Misses     108133   147853    +39720     
+ Partials     2313        9     -2304     

Flag	Coverage Δ
authIntTests	?
mgmtIntTests	?
unittests	0.22% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.