ci: set read-only workflow token permissions

[Alb3e3]

Summary

• set explicit read-only GITHUB_TOKEN permissions for CI workflows that only need repository checkout/read access
• leave release/deploy/write-capable workflows unchanged

Why

This follows GitHub Actions least-privilege guidance and reduces the default token scope available to routine CI jobs without changing the test/build commands.

Verification

• Parsed the changed workflow YAML with PyYAML.
• Ran git diff --check.

[Alb3e3]

Refreshed this one proactively: rebased onto current master (it was 15 commits behind) and signed the commit, since signed commits turned out to be the merge requirement on auth0/auth0.net#1054.

sha=c10f5101  verified=true  reason=valid

Change is unchanged — permissions: blocks on build-and-test.yml and sca_scan.yml, 6 added lines, no build or runtime changes.