Add read permissions for github tokens

[pjfanning]

Lots of people are adding this their Github CI scripts:

# https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token
# 
permissions:
  contents: read

[armanbilge]

Thanks for opening this. Adding support for configuring fine-grained permissions is indeed a very good thing to do.

I think we may need write permissions for some steps, such as site publication.