Remove excess permissions from pages workflows

[jsoref]

The various pages workflows all set a top level permissions block which was unfortunate.

With the exception of the static workflow, each workflow had two jobs, one that only needed contents: read and one that didn't even need contents: read.

I'm splitting the permissions block for each of those workflows such that the build phase only gets contents: read and the publish phase gets pages: write and id-token: write (but not even contents: read as it doesn't need it).

For the static workflow, I'm moving the permissions into the job for consistency and also to make it easier to compose this job into some bigger workflow.

I discovered the overly generous permissions when I was applying the pages/jekyll-gh-pages.yml into a workflow I have...

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.

---

Tasks

For all workflows, the workflow:

• [ ] Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
• [ ] Should use sentence case for the names of workflows and steps (for example, "Run tests").
• [ ] Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
• [ ] Should include comments in the workflow for any parts that are not obvious or could use clarification.
• [ ] Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

• [ ] Should be preserved under the ci directory.
• [ ] Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
• [ ] Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
• [ ] Packaging workflows should run on release with types: [ created ].
• [ ] Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

Some general notes:

• [ ] This workflow must only use actions that are produced by GitHub, in the actions organization, or
• [ ] This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:

  # This workflow uses actions that are not certified by GitHub.
  # They are provided by a third-party and are governed by
  # separate terms of service, privacy policy, and support
  # documentation.
  

• [ ] Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
• [ ] Automation and CI workflows cannot be dependent on a paid service or product.

[ghost]

Commit Summary

e2e880b Remove excess permissions from pages workflows

[jsoref]

@JamesMGreene can someone please look at this?

[JamesMGreene]

@jsoref I don't have the permissions to approve/merge anymore, but I'll reach out to my old team to see if anyone can get to it soon.