[CI] gha: set default workflow permissions

[jbampton]

Did you read the Contributor Guide?

• Yes, I have read the Contributor Rules and Contributor Development Guide

Is this PR related to a ticket?

• No this is a CI update. The PR name follows the format [CI] my subject

What changes were proposed in this PR?

Set workflow permissions

How was this patch tested?

Did this PR include necessary documentation updates?

• No, this PR does not affect any public API so no need to change the documentation.

[jiayuasu]

What is the purpose of this PR?

[jbampton]

zizmor is a static analysis tool for GitHub Actions. It can find many common security issues in typical GitHub Actions CI/CD setups. So I ran zizmor here and it found that we did not have our permissions set on these workflows.

https://github.com/zizmorcore/zizmor

refs #1977

The other workflows that I did not modify already had:

permissions:
  contents: read

This is the example from zizmor:

So you can compare this PR to another previous PR and see the difference in the permissions.

This PR:

Another previous PR:

[jiayuasu]

I had to revert this PR because our Github action actually deploys to our website branch, this PR broken the github action. Please fix accordingly: https://github.com/apache/sedona/actions/runs/15513400421