fix: follow the principle of least privilege

[gcanlin]

Here is a minor change in ci.yml, which doesn't make some real effect but for more secure usage of actions. GitHub official docs introduced it.

Make sure the credentials being used within workflows have the least privileges required, and be mindful that any user with write access to your repository has read access to all secrets configured in your repository.