Explicit permissions for the ci-cd workflow

[Oaphi]

Ports another minor change from the #1709 PR while it's in the works - explicit permissions for our main ci-cd GitHub Actions workflow.

Prevents code scanning from complaining upon changing the workflow file

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.78%. Comparing base (bdc4d55) to head (be4225e).
⚠️ Report is 2 commits behind head on develop.

Additional details and impacted files

Components	Coverage Δ
controllers	69.86% <ø> (ø)
helpers	81.82% <ø> (ø)
jobs	60.00% <ø> (ø)
models	86.12% <ø> (ø)

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.