CodeQL reports missing permissions declarations in workflows

[mhucka]

CodeQL security scans are flagging the workflows for lack of permissions declarations. Here's a sample warning:

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block

This concerns all of the current workflow files in .github/workflows/.