ci: add GitHub token permissions for workflows