improve security by minimizing token permissions

[FDzhang]

Hi, This follows GitHub’s official best practices for workflows and helps improve security by minimizing token permissions.