chore: add job-level permissions to workflows

[ffflorian]

Summary

This PR moves GitHub Actions workflow permissions from the global workflow level to individual jobs, implementing the principle of least privilege.

Changes

• Removed global permissions: blocks from workflow roots
• Added job-level permissions to each job based on its functionality
• All jobs receive a baseline of contents: read
• Jobs performing sensitive operations (publishing, releasing, etc.) receive additional write permissions as needed

Permissions Added

• npm publishing jobs: id-token: write, contents: write
• Security/CodeQL analysis: security-events: write, packages: read, actions: read
• Release/git operations: contents: write
• Read-only jobs: contents: read (baseline)

Benefits

✅ Improved security posture
✅ Follows GitHub Actions best practices
✅ Easier to audit job-specific permissions
✅ Aligns with principle of least privilege