GitHub Workflows security hardening

[sashashura]

This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted. It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.

[taro-bot2[bot]]

欢迎提交 PR~ Taro 非常感谢您对开源事业做出的贡献！🌷🌷🌷

一般 PR 会在一到两周内进行 review，成功合入后会随下一个版本进行发布。

Review 需要耗费大量时间，所以请遵循以下规范，协助我们提高 review 效率🙏🙏🙏

1. 详细介绍 PR 的背景（非常重要，例如解决了什么问题，该问题如何复现等）
2. 确保 CI 顺利运行。
3. 最好能提供对应的测试用例。

为了更好地进行沟通，请加入 Taro 开发者微信群：

[Chen-jj]

Thanks for contributing!