Explicit permissions for GITHUB_TOKEN

[consideRatio]

This repo has various workflows, both for itself and draft_workflows which is new to me what it means.

I'd like for this issue to represent the need to explicitly specify what permissions we need for the GITHUB_TOKEN in these workflow, so that we can default to readonly on an org level.

These permission are specified at the job level, for more details, see jupyterhub/team-compass#404

[consideRatio]

We have already defaulted to readonly on the org level.