CI: follow the least priviledge in workflow

[gcanlin]

Checklist

• [x] I read the Contribution Guidelines
• [x] I signed the CLA and WG Agreements
• [x] I ran, updated and added unit tests as necessary.
• [x] I verified the contribution matches existing coding style.
• [x] I updated the documentation if necessary.

Motivation and Context

The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.

Description

Just add the explicit allowing permission in workflow.