[TASK] Set Workflow permissions to read-only for npm-publish

[JoernBerkefeld]

Tracking issue for:

• https://github.com/Accenture/sfmc-devtools/security/code-scanning/38
• https://github.com/Accenture/sfmc-devtools/security/code-scanning/39