Minimize workflow job permissions

[samsrabin]

This is required (or at least strongly recommended) for the CIRRUS self-hosted runners.

• All jobs without permissions set: explicitly set to read-only.
• docker-image-common/build-image-and-test-docs: Does this really need write? I would think docker-image-build-publish/push-and-attest is the only one that needs it.

[samsrabin]

I don't think we actually need to do the first step. Instead, I just set the default workflow permissions to read-only, and only for contents/packages:

Let's see if that breaks anything.

[ekluzek]

I don't think we actually need to do the first step. Instead, I just set the default workflow permissions to read-only, and only for contents/packages:
...
Let's see if that breaks anything.

Looks like this is in place now, and I'm assuming nothing is breaking.